CCR-2026-0009: propose qonto-assistant workload KV read lane

QONTO-WP-0004-T06. Requests a second, workload-scoped access lane into
the existing tenants/binky/qonto-api credential (CCR-2026-0008 is
human/OIDC admin access only, not usable by a running pod). Mirrors
CCR-2026-0003's llm-connect pattern: External Secrets Operator reads
the KV path into a namespace-scoped Kubernetes Secret via a
ClusterSecretStore restricted to the new qonto-assistant namespace;
the pod never touches the OpenBao token directly.

Status: proposed, not approved -- requires platform-operator and
binky-tenant-owner sign-off before the auth role/policy are applied.
Draft ClusterSecretStore manifest included, following the same
"deployed separately, not via this kustomization" pattern as the
existing activity-core/forgejo/reuse stores. Validated against
schemas/credential-change-request.schema.yaml.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

argocd/platform-addons/openbao-secretstore/openbao-qonto-assistant.clustersecretstore.yaml

@@ -0,0 +1,36 @@
+# DRAFT -- proposed alongside CCR-2026-0009 (status: proposed, not yet
+# approved). Do not apply until CCR-2026-0009 is approved and the underlying
+# OpenBao policy + Kubernetes auth role exist.
+#
+# Mirrors openbao-activity-core.clustersecretstore.yaml's interim pattern:
+# reads from coulombcore OpenBao (https://bao.coulomb.social) via a
+# policy-limited token until railiance01 OpenBao is bootstrapped and a real
+# Kubernetes auth role (external-secrets-qonto-assistant, CCR-2026-0009) is
+# live. Scoped to the tenants mount (matches CCR-2026-0008's mount, not
+# CCR-2026-0003's platform mount) and restricted to the qonto-assistant
+# namespace only via `conditions`.
+#
+# Prereq: Secret external-secrets/openbao-qonto-assistant-eso-token (key:
+# token) with a policy-limited OpenBao token that can read
+# tenants/binky/qonto-api (API_KEY, API_USER) -- see CCR-2026-0009.
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-qonto-assistant
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+spec:
+  provider:
+    vault:
+      server: https://bao.coulomb.social
+      path: tenants
+      version: v2
+      auth:
+        tokenSecretRef:
+          name: openbao-qonto-assistant-eso-token
+          namespace: external-secrets
+          key: token
+  conditions:
+    - namespaces:
+        - qonto-assistant