RAILIANCE-WP-0012/0013/0014: Core Hub S5 release, CNPG observability, and follow-up workplans

Deliver the inbox-suggestion implementation from WP-0012: Core Hub Helm chart
and Makefile targets, CNPG backup status tooling, and updated backup handoff
docs. Archive the finished WP-0012 workplan and register ready follow-ups
WP-0013 (CNPG backup wiring + restore drill) and WP-0014 (Core Hub Helm
cutover and vergabe-teilnahme image refresh).

charts/core-hub/templates/migrate-job.yaml

@@ -0,0 +1,35 @@
+{{- if .Values.migration.enabled }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ .Values.migration.jobName }}
+  labels:
+    app.kubernetes.io/name: core-hub
+    app.kubernetes.io/component: migration
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/part-of: railiance-apps
+    {{- with .Values.runtime.coreHubEnv }}
+    environment: {{ . }}
+    {{- end }}
+spec:
+  backoffLimit: {{ .Values.migration.backoffLimit }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: core-hub
+        app.kubernetes.io/component: migration
+        app.kubernetes.io/part-of: railiance-apps
+    spec:
+      restartPolicy: Never
+      containers:
+        - name: migrate
+          image: {{ include "corehub.image" . | quote }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: ["alembic", "upgrade", "head"]
+          envFrom:
+            - configMapRef:
+                name: {{ include "corehub.runtimeConfigMapName" . }}
+            - secretRef:
+                name: {{ .Values.envSecretName | quote }}
+{{- end }}