CCR-2026-0051: ops-mason apply evidence (policy + kubernetes role)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 278674@bnt-lap001
Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f

credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml

@@ -97,7 +97,21 @@ verification:
   - Founder, platform owner and consumer owner approve the exact CCR.
   - Native bound claims confirmed (confirm-binding) and native policy/role readback
     matches source.
-  evidence: []
+  evidence:
+  - at: '2026-10-18T10:44:23+00:00'
+    actor: ops-mason (claude-MASON-WP-0014-T03, ops-mason-construct)
+    kind: apply
+    result: success
+    details:
+    - '2026-10-18: policy workload-kv-read-mas-tem-relay written from openbao/policies/workload-kv-read-mas-tem-relay.hcl;
+      read back byte-equal'
+    - 'kubernetes role external-secrets-mas-tem-relay written: SA mas-tem-relay-eso,
+      ns mas, audience openbao, token_policies [workload-kv-read-mas-tem-relay], ttl/max/explicit_max
+      15m, token_no_default_policy true; read back matches CCR'
+    - KV platform/suppliers/scaleway/mas-tem-relay present (v2, founder-written);
+      no value read
+    - 'pending: SA mas-tem-relay-eso not yet applied (bound_claims_confirmed false);
+      confirm-binding and ESO sync next'
 lifecycle:
   deactivate: Delete ExternalSecret and role external-secrets-mas-tem-relay, then
     policy workload-kv-read-mas-tem-relay, when namespace mas is torn down.