feat: propose CCR-2026-0012 for platform-pg Barman key

Workload KV path and ESO drafts for Secret platform-pg-backup-s3.
Founder mints the project-scoped Scaleway application; values stay
out of git.

openbao/policies/workload-kv-read-platform-pg-backup-s3.hcl

@@ -0,0 +1,11 @@
+# Least-privilege read of the Barman runtime key for platform-pg.
+# ESO (or the later Kubernetes auth role) is the only in-cluster reader.
+# Values never belong in Git.
+
+path "platform/data/workloads/railiance/backup/platform-pg-backup-s3" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/railiance/backup/platform-pg-backup-s3" {
+  capabilities = ["read"]
+}