feat(backup): multi-host CNPG Option A CLI for activity-core

Add cnpg-option-a-backup JSON runner, vendored static age, kubectl install
helper, and ESO policy path for offsite lane so railiance01 workers can
upload without workstation OIDC (RAILIANCE-WP-0016).

openbao/policies/external-secrets-activity-core.hcl

@@ -32,4 +32,13 @@ path "platform/data/workloads/forgejo/forgejo-admin" {
 
 path "platform/metadata/workloads/forgejo/forgejo-admin" {
   capabilities = ["read"]
+}
+
+# Offsite backup lane (NC WebDAV + age pubkey material) for Option A uploads
+path "platform/data/workloads/railiance/backup/offsite-lane" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/railiance/backup/offsite-lane" {
+  capabilities = ["read"]
 }