feat(backup): multi-host CNPG Option A CLI for activity-core

Add cnpg-option-a-backup JSON runner, vendored static age, kubectl install
helper, and ESO policy path for offsite lane so railiance01 workers can
upload without workstation OIDC (RAILIANCE-WP-0016).

docs/cnpg-option-a-backup.md

@@ -0,0 +1,56 @@
+# CNPG Option A multi-host backup
+
+**Workplan:** RAILIANCE-WP-0016  
+**CLI:** `tools/cmd/cnpg-option-a-backup`  
+**Scheduler:** activity-core `daily-cnpg-option-a-backup` (railiance01)
+
+## What it does
+
+Logical `pg_dump -Fc` → age encrypt → Nextcloud WebDAV for production-of-record
+CNPG databases on **CoulombCore** and **railiance01**. Emits JSON for
+activity-core evidence sinks.
+
+Inventory: `railiance-apps/docs/cnpg-backup-topology-inventory.md`.
+
+## Operator commands
+
+```bash
+# One-time vendor tools (age committed; kubectl downloaded)
+tools/cmd/install-cnpg-backup-vendor-tools
+
+# Dry-run (no upload)
+RAILIANCE_BACKUP_DRY_RUN=1 tools/cmd/cnpg-option-a-backup
+
+# Live upload (env or bao OIDC)
+export RAILIANCE_BACKUP_NC_TOKEN=…   # or bao login + auto-fetch
+tools/cmd/cnpg-option-a-backup
+```
+
+From railiance-apps:
+
+```bash
+make cnpg-option-a-backup-dry-run
+make cnpg-option-a-backup
+```
+
+## activity-core enable
+
+1. Re-mint ESO token with backup policy:
+   `OPENBAO_ACTIVITY_CORE_POLICIES="… workload-kv-read-railiance-backup-offsite-lane" \
+    scripts/openbao-eso-token-apply.sh`
+2. Apply `k8s/railiance/15-externalsecret-backup-offsite.yaml`
+3. Ensure `/home/tegwick/railiance-platform` and `~/.kube` on railiance01 host
+   (worker hostPath). Place CoulombCore kubeconfig as `~/.kube/config`.
+4. Rebuild/restart worker with resolver code; sync ActivityDefinition;
+   set `enabled: true` on `daily-cnpg-option-a-backup`.
+5. Forced run; check State Hub progress + `make cnpg-backup-status`.
+
+## Credentials
+
+| Field | Where |
+| --- | --- |
+| `NC_WEBDAV_TOKEN` / `NC_WEBDAV_URL` | OpenBao offsite-lane → ESO → `actcore-runtime-secret` |
+| `AGE_PUBLIC_KEY` | public constant / env (not private key) |
+| `AGE_PRIVATE_KEY` | OpenBao only — restore drills, never on worker |
+
+Catalog: `warden route show railiance-backup-offsite-lane`.