Complete EMAIL-WP-0004 transactional invitation mail delivery.

Ship the railiance01 deploy package (OpenBao/ESO custody, NetworkPolicy,
probes), provider failure classification and suppression, T04 unit and live
proof, and non-secret NK-WP-0024 hand-back evidence. Workplan finished.

deploy/k8s/railiance/openbao-eso-token-apply.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# Mint a read-limited OpenBao token and store it on railiance01 for
+# ClusterSecretStore openbao-email-connect / ExternalSecret email-connect-runtime.
+#
+# Policies (files in railiance-platform/openbao/policies/):
+#   external-secrets-email-connect
+#   workload-kv-read-email-connect-transactional  (optional operator OIDC sibling)
+#
+# Does not print secret values. Requires an attended operator OpenBao token.
+# CCR-2026-0010 must be approved before production use.
+set -euo pipefail
+
+DEFAULT_POLICIES="external-secrets-email-connect"
+POLICIES="${OPENBAO_EMAIL_CONNECT_POLICIES:-$DEFAULT_POLICIES}"
+POLICY_DIR="${OPENBAO_POLICY_DIR:-$HOME/railiance-platform/openbao/policies}"
+BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
+RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-hosteurope}"
+SECRET_NAME="${OPENBAO_EMAIL_CONNECT_ESO_SECRET:-openbao-email-connect-eso-token}"
+SECRET_NS="${OPENBAO_EMAIL_CONNECT_ESO_NAMESPACE:-external-secrets}"
+TTL="${OPENBAO_EMAIL_CONNECT_ESO_TTL:-768h}"
+
+if ! command -v bao >/dev/null 2>&1; then
+  echo "ERROR: bao CLI not found" >&2
+  exit 1
+fi
+if ! command -v kubectl >/dev/null 2>&1; then
+  echo "ERROR: kubectl not found" >&2
+  exit 1
+fi
+
+echo "OpenBao addr: $BAO_ADDR"
+echo "Policies: $POLICIES"
+echo "K8s secret: $SECRET_NS/$SECRET_NAME (railiance01)"
+
+if [[ -n "${BAO_TOKEN:-}" ]]; then
+  :
+elif [[ -n "${OPENBAO_TOKEN_FILE:-}" && -f "${OPENBAO_TOKEN_FILE}" ]]; then
+  BAO_TOKEN="$(head -n 1 "${OPENBAO_TOKEN_FILE}")"
+else
+  read -r -s -p "OpenBao operator token: " BAO_TOKEN
+  echo >&2
+fi
+if [[ -z "${BAO_TOKEN:-}" ]]; then
+  echo "ERROR: empty OpenBao token" >&2
+  exit 1
+fi
+
+export BAO_ADDR BAO_TOKEN
+
+health="$(curl -fsS "$BAO_ADDR/v1/sys/health")"
+if echo "$health" | grep -q '"sealed":true'; then
+  echo "ERROR: OpenBao at $BAO_ADDR reports sealed" >&2
+  exit 1
+fi
+
+for policy in $POLICIES; do
+  policy_file="$POLICY_DIR/${policy}.hcl"
+  if [[ -f "$policy_file" ]]; then
+    bao policy write "$policy" "$policy_file"
+    echo "policy written: $policy"
+  else
+    echo "WARN: policy file missing ($policy_file); using existing OpenBao policy '$policy'" >&2
+  fi
+done
+
+# Child token: renewable, orphan so operator logout does not revoke delivery.
+# shellcheck disable=SC2086
+token_json="$(bao token create -policy="$(echo $POLICIES | tr ' ' ',')" -ttl="$TTL" -renewable=true -orphan -format=json)"
+child_token="$(printf '%s' "$token_json" | python3 -c 'import json,sys; print(json.load(sys.stdin)["auth"]["client_token"])')"
+if [[ -z "$child_token" || ${#child_token} -lt 8 ]]; then
+  echo "ERROR: failed to mint child token" >&2
+  exit 1
+fi
+echo "minted child token length=${#child_token} (value not printed)"
+
+export KUBECONFIG="$RAILIANCE01_KUBECONFIG"
+kubectl -n "$SECRET_NS" create secret generic "$SECRET_NAME" \
+  --from-literal=token="$child_token" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+unset child_token BAO_TOKEN
+echo "Secret $SECRET_NS/$SECRET_NAME applied on railiance01."
+echo "Next: apply ClusterSecretStore openbao-email-connect, then email-connect package."