MAS-WP-0003: explicit ExternalSecret target metadata (reject-secret-last-applied)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 252470@bnt-lap001
Assistant-Session: ad628c8f-4be2-4979-94c9-76c7ed6f8241

deploy/railiance/manifests.yaml

@@ -48,7 +48,14 @@ metadata: {name: mas-relay, namespace: mas}
 spec:
   refreshInterval: 1h
   secretStoreRef: {name: openbao-mas-tem-relay, kind: SecretStore}
-  target: {name: mas-relay, creationPolicy: Owner}
+  target:
+    name: mas-relay
+    creationPolicy: Owner
+    # Explicit target metadata stops ESO copying the last-applied annotation,
+    # which policy reject-secret-last-applied forbids on Secrets.
+    template:
+      metadata:
+        labels: {app.kubernetes.io/name: mas-mx}
   data:
     - {secretKey: username, remoteRef: {key: suppliers/scaleway/mas-tem-relay, property: username}}
     - {secretKey: password, remoteRef: {key: suppliers/scaleway/mas-tem-relay, property: password}}