RAILIANCE-WP-0015: use workstation cron; suspend in-cluster CronJobs

Cluster egress blocks age installs (github + Alpine CDN). Declare
workstation-cron schedule ConfigMap as the unattended path and keep
Option A CronJobs suspended until a prebuilt image is available.

manifests/cnpg-option-a-backup.yaml

@@ -3,17 +3,41 @@
 # Decided approach (not barman ScheduledBackup). Applies to CoulombCore
 # databases namespace clusters: apps-pg, gitea-db, net-kingdom-pg, state-hub-db.
 #
+# Unattended path (primary): workstation cron (same pattern as forgejo-backup).
+# CoulombCore pods cannot reach github.com / Alpine CDN to fetch `age`, so
+# in-cluster CronJobs are shipped **suspended**. Enable only after an image
+# with kubectl+age+curl is available in-cluster.
+#
 # Prereqs:
 #   1. OpenBao lane CCR-2026-0004 resolvable
 #   2. make cnpg-backup-offsite-secret-apply   # Secret cnpg-backup-offsite
 #   3. kubectl apply -f manifests/cnpg-option-a-backup.yaml
+#   4. Install workstation cron (see schedule ConfigMap / docs)
 #
 # Schedule: daily 02:30 UTC (RPO 24h). Retention target 14 daily + 4 weekly
-# is enforced on the Nextcloud side / operator prune; local Job pods are ephemeral.
+# is enforced on the Nextcloud side / operator prune.
 #
 # Health: make cnpg-backup-status
 ---
 apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cnpg-option-a-schedule
+  namespace: databases
+  labels:
+    app.kubernetes.io/part-of: railiance-apps
+    railiance.apps/backup-lane: option-a
+data:
+  mode: workstation-cron
+  schedule: "30 2 * * *"
+  command: "cd $HOME/railiance-apps && make cnpg-logical-backup"
+  clusters: "apps-pg,gitea-db,net-kingdom-pg,state-hub-db"
+  rpo_hours: "24"
+  rto_hours: "4"
+  retention: "14 daily + 4 weekly (Nextcloud operator prune)"
+  note: "In-cluster CronJobs suspended until image with age is available without egress installs"
+---
+apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: cnpg-logical-backup
@@ -79,17 +103,19 @@ data:
     DATABASES="${DATABASES:?DATABASES required}"
     NAMESPACE="${NAMESPACE:-databases}"
     STATUS_CM="${STATUS_CM:-cnpg-option-a-status}"
-    AGE_BIN="${AGE_BIN:-/tmp/age/age}"
     WORK=/tmp/backup-work
-    mkdir -p "$WORK" /tmp/age
+    mkdir -p "$WORK"
 
-    if [ ! -x "$AGE_BIN" ]; then
-      echo "fetch age static binary"
-      curl -fsSL "https://github.com/FiloSottile/age/releases/download/v1.2.1/age-v1.2.1-linux-amd64.tar.gz" \
-        | tar -xz -C /tmp
-      # tarball extracts to /tmp/age/age
-      AGE_BIN=/tmp/age/age
+    # Prefer distro package (cluster often cannot reach github.com).
+    if ! command -v age >/dev/null 2>&1; then
+      echo "install age via apk"
+      apk add --no-cache age >/dev/null
     fi
+    if ! command -v age >/dev/null 2>&1; then
+      echo "ERROR: age not available (apk install failed; github fallback disabled)" >&2
+      exit 1
+    fi
+    AGE_BIN="$(command -v age)"
 
     NC_TOKEN="$(cat /secrets/offsite/NC_WEBDAV_TOKEN)"
     NC_URL="$(cat /secrets/offsite/NC_WEBDAV_URL)"
@@ -160,6 +186,7 @@ metadata:
     railiance.apps/backup-cluster: apps-pg
 spec:
   schedule: "30 2 * * *"
+  suspend: true
   concurrencyPolicy: Forbid
   successfulJobsHistoryLimit: 3
   failedJobsHistoryLimit: 3
@@ -221,6 +248,7 @@ metadata:
     railiance.apps/backup-cluster: gitea-db
 spec:
   schedule: "35 2 * * *"
+  suspend: true
   concurrencyPolicy: Forbid
   successfulJobsHistoryLimit: 3
   failedJobsHistoryLimit: 3
@@ -282,6 +310,7 @@ metadata:
     railiance.apps/backup-cluster: net-kingdom-pg
 spec:
   schedule: "40 2 * * *"
+  suspend: true
   concurrencyPolicy: Forbid
   successfulJobsHistoryLimit: 3
   failedJobsHistoryLimit: 3
@@ -343,6 +372,7 @@ metadata:
     railiance.apps/backup-cluster: state-hub-db
 spec:
   schedule: "45 2 * * *"
+  suspend: true
   concurrencyPolicy: Forbid
   successfulJobsHistoryLimit: 3
   failedJobsHistoryLimit: 3