NK-WP-0056-T04: bind ESO sets explicit target metadata so the last-applied annotation is not copied

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 673304@bnt-lap001
Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e

sso-mfa/k8s/identity-provisioner/bind-eso.yaml

@@ -42,6 +42,10 @@ spec:
     kind: SecretStore
     name: net-kingdom-svc-provisioner-bind
   target:
+    # Explicit target metadata stops ESO copying this object's kubectl
+    # last-applied annotation onto the Secret (refused by reject-secret-last-applied).
+    template:
+      metadata: {}
     name: identity-provisioner-ldap
     creationPolicy: Merge
     deletionPolicy: Retain

tests/test_service_bind_lane.py

@@ -175,7 +175,8 @@ def test_manifest_matches_contract():
     sa, store, es = docs
     assert sa['metadata'] == {'name': 'net-kingdom-svc-provisioner-bind-eso', 'namespace': 'sso'}
     assert store['spec']['provider']['vault']['auth']['kubernetes']['role'] == 'net-kingdom-svc-provisioner-bind-eso'
-    assert es['spec']['target'] == {'name': 'identity-provisioner-ldap', 'creationPolicy': 'Merge', 'deletionPolicy': 'Retain'}
+    assert es['spec']['target'] == {'template': {'metadata': {}}, 'name': 'identity-provisioner-ldap',
+                                    'creationPolicy': 'Merge', 'deletionPolicy': 'Retain'}
     assert es['spec']['data'] == [{'secretKey': 'password', 'remoteRef': {
         'key': 'workloads/net-kingdom/directory-binds/svc-provisioner', 'property': 'LDAP_BIND_PASSWORD'}}]