Deploy reuse-surface runtime secrets via OpenBao External Secrets

Add openbao-reuse ClusterSecretStore handoff, reuse-surface-runtime
ExternalSecret, ESO token bootstrap script, and Makefile targets for
CCR-2026-0005 / RAILIANCE-WP-0011.

manifests/reuse-surface-runtime-externalsecret.yaml

@@ -0,0 +1,35 @@
+# reuse-surface hub runtime secrets from OpenBao (RAILIANCE-WP-0011 / CCR-2026-0005).
+#
+# OpenBao path (platform KV v2): workloads/reuse/reuse-surface/runtime-secrets
+# Fields: REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
+#
+# Prereqs on railiance01:
+#   - External Secrets Operator (make eso-deploy)
+#   - ClusterSecretStore openbao-reuse (railiance-platform openbao-secretstore)
+#   - OpenBao policy workload-kv-read-reuse-surface-runtime + ESO token
+#     (make reuse-openbao-eso-token-apply)
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: reuse-surface-runtime
+  namespace: reuse
+  labels:
+    app.kubernetes.io/name: reuse-surface
+    app.kubernetes.io/part-of: railiance-apps
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-reuse
+  target:
+    name: reuse-surface-env
+    creationPolicy: Owner
+  data:
+    - secretKey: REUSE_SURFACE_TOKEN
+      remoteRef:
+        key: workloads/reuse/reuse-surface/runtime-secrets
+        property: REUSE_SURFACE_TOKEN
+    - secretKey: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
+      remoteRef:
+        key: workloads/reuse/reuse-surface/runtime-secrets
+        property: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET