fix(security): prevent ESO copying source annotations (CUST-WP-0073)

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da

manifests/forgejo-mailer-externalsecret.yaml

@@ -21,6 +21,12 @@ spec:
     kind: ClusterSecretStore
     name: openbao-forgejo
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/name: forgejo
+          app.kubernetes.io/part-of: railiance-apps
     name: forgejo-mailer
     creationPolicy: Owner
   data:

manifests/reuse-surface-runtime-externalsecret.yaml

@@ -22,6 +22,12 @@ spec:
     kind: ClusterSecretStore
     name: openbao-reuse
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/name: reuse-surface
+          app.kubernetes.io/part-of: railiance-apps
     name: reuse-surface-env
     creationPolicy: Owner
   data: