RPF-WP-0064-T07: in-memory /openbao/audit for the restored file audit device; native reseal regression

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4384@bnt-lap001
Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64

scripts/openbao-isolated-restore/restore_adapter.py

@@ -155,6 +155,11 @@ TMPFS = {
     # The image declares VOLUMEs here; tmpfs overlays stop anonymous volumes.
     "/openbao/file": "rw,nosuid,nodev,noexec,size=1048576,uid=100,gid=1000,mode=0700",
     "/openbao/logs": "rw,nosuid,nodev,noexec,size=1048576,uid=100,gid=1000,mode=0700",
+    # Production declares a file audit device at /openbao/audit/openbao-audit.log
+    # (rapp-openbao values). The restored audit table re-enables it on unseal; if
+    # the path is unwritable OpenBao seals itself again (T07 attempts -01/-02).
+    # The log holds HMAC'd entries only and dies with the container.
+    "/openbao/audit": "rw,nosuid,nodev,noexec,size=16777216,uid=100,gid=1000,mode=0700",
 }
 DIGEST_RE = re.compile(r"^sha256:[a-f0-9]{64}$")
 IMAGE_RE = re.compile(r"^" + re.escape(IMAGE_REPOSITORY) + r"@(sha256:[a-f0-9]{64})$")