Add reuse-webhook-smoke and rotation runbook links

RAILIANCE-WP-0011-T04: smoke checks unsigned 401, signed no-op 200, ESO Ready,
and /v1/federated; point operator docs at platform rotation runbook.

docs/reuse-surface-on-railiance01.md

@@ -69,13 +69,18 @@ kubectl --kubeconfig ~/.kube/config-hosteurope rollout restart deployment/reuse-
 kubectl --kubeconfig ~/.kube/config-hosteurope rollout status deployment/reuse-surface -n reuse
 ```
 
-**Bootstrap / rotate** (update OpenBao fields — never commit or paste into chat):
+**Rotation** (never commit or paste values into chat):
+
+Full procedure: `railiance-platform/docs/reuse-surface-runtime-secrets-rotation-runbook.md`
 
 ```bash
-# Operator: update both fields in OpenBao, then refresh ESO and roll the Deployment
+# After updating field(s) in OpenBao — force ESO sync, roll hub, reconcile webhook if needed
+kubectl --kubeconfig ~/.kube/config-hosteurope annotate externalsecret \
+  reuse-surface-runtime -n reuse force-sync="$(date +%s)" --overwrite
 make reuse-runtime-es-status
 kubectl --kubeconfig ~/.kube/config-hosteurope rollout restart deployment/reuse-surface -n reuse
-make reuse-forgejo-webhook   # required when rotating REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
+make reuse-forgejo-webhook   # required when REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET changed
+make reuse-webhook-smoke
 ```
 
 One-time lane bootstrap (CCR-2026-0005):
@@ -113,12 +118,10 @@ Requires a Forgejo admin API token at `/tmp/forgejo-tegwick-api-token` (or
 make reuse-forgejo-webhook
 ```
 
-Manual verification (unsigned body should return `401`, not `503`):
+Smoke (unsigned `401`, signed no-op `200`, ESO Ready, `/v1/federated`):
 
 ```bash
-curl -fsS -o /dev/null -w "%{http_code}\n" -X POST \
-  https://reuse.coulomb.social/v1/webhooks/forgejo \
-  -H "Content-Type: application/json" -d '{}'
+make reuse-webhook-smoke
 ```
 
 Live status (2026-07-07): org webhook id `1` on `coulomb` →