Add OpenBao/ESO lane for target-revenue on railiance01

ClusterSecretStore openbao-target-revenue and read policies for
platform/workloads/target-revenue/runtime-secrets (WP-0011).

argocd/platform-addons/openbao-secretstore/openbao-target-revenue.clustersecretstore.yaml

@@ -0,0 +1,28 @@
+# target-revenue Trust Service runtime secrets on railiance01 (WP-0011).
+# Pattern matches openbao-reuse / openbao-activity-core: token auth to the
+# in-cluster OpenBao service, store limited to the target-revenue namespace.
+#
+# Prereq: Secret external-secrets/openbao-target-revenue-eso-token (key: token)
+# Bootstrap: target-revenue scripts/openbao-eso-token-apply.sh
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-target-revenue
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+    railiance.io/domain: target-revenue
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        tokenSecretRef:
+          name: openbao-target-revenue-eso-token
+          namespace: external-secrets
+          key: token
+  conditions:
+    - namespaces:
+        - target-revenue

openbao/policies/external-secrets-target-revenue.hcl

@@ -0,0 +1,9 @@
+# ESO policy for the target-revenue namespace (WP-0011).
+
+path "platform/data/workloads/target-revenue/*" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/target-revenue/*" {
+  capabilities = ["read", "list"]
+}

openbao/policies/workload-kv-read-target-revenue-runtime.hcl

@@ -0,0 +1,9 @@
+# Read-only policy for Target Revenue Trust Service runtime secrets (WP-0011).
+
+path "platform/data/workloads/target-revenue/runtime-secrets" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/target-revenue/runtime-secrets" {
+  capabilities = ["read"]
+}