feat: propose CCR-2026-0012 for platform-pg Barman key

Workload KV path and ESO drafts for Secret platform-pg-backup-s3.
Founder mints the project-scoped Scaleway application; values stay
out of git.

argocd/platform-addons/openbao-secretstore/openbao-platform-pg-backup.clustersecretstore.yaml

@@ -0,0 +1,32 @@
+# DRAFT — CCR-2026-0012. Do not apply until the CCR is approved and the
+# KV values are real. Deploy on railiance01 (databases lives there), not
+# the CoulombCore ArgoCD kustomization.
+#
+# Prereq: ESO can authenticate to OpenBao with policy
+# workload-kv-read-platform-pg-backup-s3. Interim railiance01 identity
+# may be AppRole or a child token; Kubernetes auth role
+# external-secrets-platform-pg-backup is the CCR-declared steady state.
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-platform-pg-backup
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+    app.kubernetes.io/name: platform-pg-backup
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets-platform-pg-backup
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets
+  conditions:
+    - namespaces:
+        - databases