Place the ESO audience under serviceAccountRef (ESO v1 schema)

The server dry run rejected spec.provider.vault.auth.kubernetes.audiences. The
same audience, openbao, now sits under serviceAccountRef, as in openbao-reuse.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b

docs/provisioning-windows/2026-10-04-1000/keycape/eso.draft.yaml

@@ -16,11 +16,11 @@ spec:
         kubernetes:
           mountPath: kubernetes
           role: external-secrets-keycape-secrets-engine-openbao
-          audiences:
-          - openbao
           serviceAccountRef:
             name: external-secrets
             namespace: external-secrets
+            audiences:
+            - openbao
   conditions:
   - namespaces:
     - sso