RPF-WP-0046-T04: adopt eso-token-renewer Application (pinned b2ebe10); close RPF-WP-0045

- WP-0045-T06 done: both dead static-token Secrets deleted after a no-reference recheck.
- Renewer Application moved from drafts to railiance01 applications; inert until
  the AppProject carries batch/CronJob and the root is synced by hand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

argocd/platform-addons/eso-token-renewer/kustomization.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 # RPF-WP-0046. Read only by the railiance01 Application in
-# argocd/railiance01/drafts/eso-token-renewer.application.yaml. No coulombcore
+# argocd/railiance01/applications/eso-token-renewer.application.yaml. No coulombcore
 # Application points here.
 
 namespace: external-secrets

argocd/railiance01/applications/eso-token-renewer.application.yaml

@@ -1,7 +1,6 @@
-# DRAFT for railiance01 (RPF-WP-0046-T04). Not synced by any root: move to
-# ../applications/ only in T04, with the founder's go-ahead, after the
-# platform-addons AppProject carries batch/CronJob. No automated sync, no
-# finalizer. Set targetRevision to the reviewed commit at adoption.
+# railiance01 child Application (RPF-WP-0046-T04, founder go-ahead 2026-09-23).
+# Requires the platform-addons AppProject to carry batch/CronJob. No automated
+# sync, no finalizer; targetRevision is the reviewed renewer commit.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -16,7 +15,7 @@ spec:
   project: railiance-platform-addons
   source:
     repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git
-    targetRevision: PIN-AT-ADOPTION
+    targetRevision: b2ebe108495c4d06ebb6ca33893ea4a2a23c9725
     path: argocd/platform-addons/eso-token-renewer
   destination:
     server: https://kubernetes.default.svc