WP-0014: Helm adopt and deploy Core Hub on CoulombCore; backup auth tooling

Adopt live Core Hub resources, align prod ConfigMap naming, default production
image registry to gitea, and install Helm release core-hub rev 1 (smoke passed).
Add apps-pg-backup and check-backup-lane-auth targets; document OIDC login
requirement now that OpenBao is unsealed.

tools/check-backup-lane-auth.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+path="${RAILIANCE_BACKUP_BAO_PATH:-platform/workloads/railiance/backup/offsite-lane}"
+
+if ! bao status >/dev/null 2>&1; then
+  echo "ERROR: cannot reach OpenBao at ${BAO_ADDR:-https://bao.coulomb.social}" >&2
+  exit 1
+fi
+
+sealed="$(bao status -format=json 2>/dev/null | python3 -c "import json,sys; print(json.load(sys.stdin).get('sealed', True))")"
+if [[ "$sealed" == "True" ]]; then
+  echo "ERROR: OpenBao is sealed" >&2
+  exit 1
+fi
+echo "ok: OpenBao unsealed"
+
+if bao token lookup >/dev/null 2>&1; then
+  echo "ok: caller token valid"
+else
+  echo "WARN: no valid caller token — run OIDC login:" >&2
+  echo "  bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read" >&2
+  exit 1
+fi
+
+if bao kv metadata get "$path" >/dev/null 2>&1; then
+  echo "ok: backup offsite-lane path readable"
+else
+  echo "ERROR: cannot read metadata for ${path}" >&2
+  exit 1
+fi

tools/core-hub-helm-adopt.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Adopt live Core Hub manifests into Helm release ownership (WP-0014-T02).
+set -euo pipefail
+
+namespace="${CORE_HUB_NAMESPACE:-core-hub}"
+release="${CORE_HUB_RELEASE:-core-hub}"
+
+resources=(
+  "deployment/core-hub-api"
+  "service/core-hub-api"
+  "configmap/core-hub-prod-runtime"
+  "ingress/core-hub"
+)
+
+echo "Adopting Core Hub resources into Helm release ${release}/${namespace}"
+for resource in "${resources[@]}"; do
+  echo "  ${resource}"
+  kubectl annotate -n "$namespace" "$resource" \
+    meta.helm.sh/release-name="$release" \
+    meta.helm.sh/release-namespace="$namespace" \
+    --overwrite
+  kubectl label -n "$namespace" "$resource" \
+    app.kubernetes.io/managed-by=Helm \
+    --overwrite
+done
+
+echo "ok: adoption metadata applied — run core-hub-server-dry-run next"