Add OpenBao emergency drill evidence validator

docs/openbao.md

@@ -322,6 +322,16 @@ Audit Core backend that writes JSONL records under
 days. Use it only to wire interfaces and setup validation before the durable
 Audit Core archive exists.
 
+Emergency seal/unseal drills are disruptive and must only run in an attended
+window with threshold unseal shares available. Record non-secret drill evidence
+using `docs/openbao-emergency-drill-evidence.example.json` as a template, then
+validate it with:
+
+```bash
+make openbao-validate-emergency-evidence \
+  OPENBAO_EMERGENCY_EVIDENCE=/path/to/evidence.json
+```
+
 Monitoring baseline:
 
 - pod readiness and liveness from Kubernetes probes