Deploy scoped user-engine delivery lanes

tools/sync-user-engine-delivery-secret.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Copy only the two scoped receiver credentials into user-engine. Values stay
+# in process memory and Kubernetes API requests; stdout contains metadata only.
+audit_json="$(kubectl -n audit-core get secret audit-core-senders -o jsonpath='{.data.senders\.json}' | base64 -d)"
+event_token="$(python3 -c 'import json,sys; rows=json.load(sys.stdin); print(next(row["tokens"][0] for row in rows if row["name"] == "user-engine"))' <<<"$audit_json")"
+mail_token="$(kubectl -n email-connect get secret email-connect-runtime -o jsonpath='{.data.EMAIL_CONNECT_INGEST_TOKEN}' | base64 -d)"
+
+test -n "$event_token"
+test -n "$mail_token"
+
+kubectl -n user-engine create secret generic user-engine-delivery \
+  --from-literal=event-token="$event_token" \
+  --from-literal=mail-token="$mail_token" \
+  --dry-run=client -o yaml \
+  | kubectl apply -f - >/dev/null
+
+echo "user-engine delivery Secret synchronized (values withheld)"