RAILIANCE-WP-0012/0013/0014: Core Hub S5 release, CNPG observability, and follow-up workplans

Deliver the inbox-suggestion implementation from WP-0012: Core Hub Helm chart
and Makefile targets, CNPG backup status tooling, and updated backup handoff
docs. Archive the finished WP-0012 workplan and register ready follow-ups
WP-0013 (CNPG backup wiring + restore drill) and WP-0014 (Core Hub Helm
cutover and vergabe-teilnahme image refresh).

manifests/cnpg-backup-readiness.yaml

@@ -0,0 +1,52 @@
+# Operator-ready CNPG backup wiring template for railiance01 production DB clusters.
+# Do not apply until platform supplies object-store credentials and destinationPath.
+# Secrets referenced below are placeholders — create them via OpenBao/operator paths.
+#
+# Clusters covered: apps-pg, forgejo-db, net-kingdom-pg, state-hub-db
+# Check posture: make cnpg-backup-status
+#
+# Apply sequence (after credentials exist):
+#   1. Create Secret cnpg-backup-s3 in namespace databases
+#   2. Uncomment and patch ObjectStore + cluster backup patches per cluster
+#   3. Apply ScheduledBackup resources
+#   4. Run restore drill in isolated namespace; record non-secret evidence
+---
+# apiVersion: barmancloud.cnpg.io/v1
+# kind: ObjectStore
+# metadata:
+#   name: railiance-cnpg-backups
+#   namespace: databases
+#   labels:
+#     app.kubernetes.io/part-of: railiance-apps
+# spec:
+#   configuration:
+#     destinationPath: s3://REPLACE_ME/railiance-cnpg/
+#     endpointURL: https://REPLACE_ME
+#     s3Credentials:
+#       accessKeyId:
+#         name: cnpg-backup-s3
+#         key: ACCESS_KEY_ID
+#       secretAccessKey:
+#         name: cnpg-backup-s3
+#         key: SECRET_ACCESS_KEY
+#     wal:
+#       compression: gzip
+#     data:
+#       compression: gzip
+#       immediateCheckpoint: true
+#   retentionPolicy: 14d
+---
+# Example ScheduledBackup for apps-pg (repeat per cluster with spec.cluster.name)
+# apiVersion: postgresql.cnpg.io/v1
+# kind: ScheduledBackup
+# metadata:
+#   name: apps-pg-daily
+#   namespace: databases
+#   labels:
+#     app.kubernetes.io/part-of: railiance-apps
+# spec:
+#   schedule: "0 0 2 * * *"
+#   backupOwnerReference: self
+#   cluster:
+#     name: apps-pg
+#   immediate: true