feat(backup): multi-host CNPG Option A CLI for activity-core

Add cnpg-option-a-backup JSON runner, vendored static age, kubectl install
helper, and ESO policy path for offsite lane so railiance01 workers can
upload without workstation OIDC (RAILIANCE-WP-0016).

tools/cmd/install-cnpg-backup-vendor-tools

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Install static age + kubectl into tools/vendor/bin for activity-core hostPath.
+# Run on railiance01 (or any backup runner host) once; kubectl is not committed.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+BIN="${ROOT}/tools/vendor/bin"
+mkdir -p "$BIN"
+
+AGE_VER="${AGE_VERSION:-v1.2.1}"
+KUBECTL_VER="${KUBECTL_VERSION:-v1.31.12}"
+
+if [[ ! -x "${BIN}/age" ]]; then
+  echo "fetch age ${AGE_VER}"
+  tmp="$(mktemp -d)"
+  curl -fsSL "https://github.com/FiloSottile/age/releases/download/${AGE_VER}/age-${AGE_VER}-linux-amd64.tar.gz" \
+    | tar -xz -C "$tmp"
+  install -m 0755 "${tmp}/age/age" "${BIN}/age"
+  rm -rf "$tmp"
+fi
+
+if [[ ! -x "${BIN}/kubectl" ]]; then
+  echo "fetch kubectl ${KUBECTL_VER}"
+  curl -fsSLo "${BIN}/kubectl" \
+    "https://dl.k8s.io/release/${KUBECTL_VER}/bin/linux/amd64/kubectl"
+  chmod 0755 "${BIN}/kubectl"
+fi
+
+# curl is usually present; verify
+for t in age kubectl curl; do
+  if ! command -v "$t" >/dev/null 2>&1 && [[ ! -x "${BIN}/$t" ]]; then
+    echo "ERROR: missing $t" >&2
+    exit 1
+  fi
+done
+
+echo "ok: vendor tools in ${BIN}"
+ls -la "$BIN"