Deploy scoped user-engine delivery lanes

sso-mfa/k8s/user-engine/README.md

@@ -18,6 +18,13 @@ service token at `platform/workloads/user-engine/runtime`. The
 `openbao-runtime.yaml` stores and ExternalSecrets deliver those values into the
 existing namespaced Secret names without changing application interfaces.
 
+The audit-core sender and email-connect ingest credentials stay authoritative
+in their provider namespaces. Run
+`tools/sync-user-engine-delivery-secret.sh` from the repository root to copy
+only those scoped values into `user-engine-delivery` without printing them.
+Rerun it after either provider rotates its token, then restart user-engine
+because the application receives these two values as environment variables.
+
 ```bash
 kubectl apply -f openbao-runtime.yaml
 kubectl apply -f runtime.yaml

sso-mfa/k8s/user-engine/runtime.yaml

@@ -45,7 +45,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: portal
-          image: forgejo.coulomb.social/coulomb/user-engine@sha256:ffca598fab9c035b58a40ae6c2be365497743a7594bc584124ab231383f25d8a
+          image: forgejo.coulomb.social/coulomb/user-engine@sha256:4eac10bf157e48eeadef16a2da83a00933914c9d37338f01679692008de21565
           imagePullPolicy: IfNotPresent
           ports: [{name: http, containerPort: 8080}]
           env: