RPF-WP-0046-T04: adopt eso-token-renewer Application (pinned b2ebe10); close RPF-WP-0045

- WP-0045-T06 done: both dead static-token Secrets deleted after a no-reference recheck.
- Renewer Application moved from drafts to railiance01 applications; inert until
  the AppProject carries batch/CronJob and the root is synced by hand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

workplans/RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md

@@ -4,12 +4,12 @@ type: workplan
 title: "Move openbao-activity-core and openbao-email-connect off expired static tokens to Kubernetes auth"
 domain: financials
 repo: railiance-platform
-status: active
+status: finished
 flavor: implementation
 owner: railiance-platform
 topic_slug: railiance
 created: "2026-09-21"
-updated: "2026-09-22"
+updated: "2026-09-23"
 related: [RPF-WP-0037]
 state_hub_workstream_id: "0edc6426-9cc8-5bbe-88ea-c27d9862d96e"
 ---
@@ -224,7 +224,7 @@ RPF-WP-0037 does.
 
 ```task
 id: RPF-WP-0045-T06
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "f56d7096-e005-5dd5-afa0-b1affe247fa7"
 ```
@@ -295,3 +295,12 @@ and `email-connect/deploy/k8s/railiance/openbao-eso-token-apply.sh`, and update
   failing (four in core-hub, two in tenant-engine). This is the failure mode
   named in the Risks section above. It needs the same Kubernetes-auth
   migration, with an attended admin login.
+
+## Closure — 2026-09-23
+
+- **T06 done.** Founder go-ahead 2026-09-23. A recheck found no store
+  referencing either Secret, so both were deleted:
+  `external-secrets/openbao-activity-core-eso-token` and
+  `openbao-email-connect-eso-token`. The bootstrap targets were retired by
+  their owners: activity-core `b690ce0`, confirmed in hub message `65b1387a`.
+  email-connect was notified.

workplans/RPF-WP-0046-eso-database-token-renewal.md

@@ -124,6 +124,15 @@ state_hub_task_id: "28726b1b-3777-5945-859b-9e563b12fee6"
    `kubectl -n external-secrets create job --from=cronjob/eso-token-renewer eso-token-renewer-first`.
    Every lane must print `ok: true` with a TTL of 604800.
 
+T04 progress, 2026-09-23 (founder go-ahead):
+
+- A `kubectl diff` of the AppProject showed only `+ batch/CronJob`. The
+  session's permission guard blocked the apply ("Shared Cluster Mutation"), so
+  the founder runs step 1.
+- Step 2 is done in git. The Application was moved to
+  `argocd/railiance01/applications/` and pinned to `b2ebe10`. The root has no
+  automated sync, so nothing changes until the manual root sync.
+
 ## T05 Move consumers off leases from the old tokens before 2026-10-25
 
 ```task