RPF-WP-0063-T01: prepare wave-2 requests (ESO, openbao UI gateway, forgejo-db)

Requests only, limits unchanged; no apply. ESO values file for the Helm
release (+ draft Application mirror), openbao-ui-gateway CPU 25m->10m,
forgejo-db 105m/288Mi. Playwright change lives in rapp-playwright 1557742.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c

workplans/RPF-WP-0063-wave2-resource-right-sizing.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Wave-2 resource right-sizing from the 2026-10-21 allocation review"
 domain: financials
 repo: railiance-platform
-status: ready
+status: active
 flavor: implementation
 owner: claude
 created: "2026-10-21"
@@ -60,4 +60,42 @@ Steps:
 
 Verification: `kubectl -n <ns> get pod -o jsonpath='{..resources}'` shows the new requests; pods Ready with no new restarts or OOMKilled over 24h; for CPU decreases the throttle ratio and request latency stay at or below the 7d baseline; node request total drops by the expected delta.
 
+Prepared 2026-10-22 (wave-2 worker W3; no apply, cluster read-only). Each
+render was diffed against live with `kubectl diff` (Secret objects skipped):
+
+- `external-secrets` x3 — live source is Helm release `external-secrets`
+  (rev 8, chart 0.16.1, not Argo; the Argo Application is still a draft).
+  New `helm/external-secrets-resources.values.yaml` (force-added; `helm/*.yaml`
+  is gitignored); the draft Application values mirror it. Render = chart 0.16.1
+  + `installCRDs: true` + `serviceAccount` (draft values minus the Argo CRD
+  annotation, which live does not carry) + this file: diff = only the three
+  Deployments' `resources.requests.{cpu,memory}`. Apply:
+  `helm upgrade external-secrets external-secrets --repo https://charts.external-secrets.io --version 0.16.1 -n external-secrets --reuse-values -f helm/external-secrets-resources.values.yaml`.
+  Restarts controller, cert-controller and webhook (brief ExternalSecret
+  admission/refresh pause; no ingress impact).
+- `openbao/railiance-platform` = Deployment `openbao-ui-gateway` (label
+  part-of railiance-platform), container `nginx`, `helm/openbao-ui-overlay-k8s.yaml`:
+  CPU request 25m -> 10m. Rendered through `scripts/openbao-ui-overlay-apply.sh`
+  with apply turned into diff: only `resources.requests.cpu`; ConfigMaps clean.
+  Apply: `make openbao-overlay-apply` (it always does a rollout restart of the
+  private UI gateway; OpenBao itself is untouched).
+- `databases/forgejo-db` (CNPG, `helm/forgejo-db-cluster.yaml`): requests
+  200m/512Mi -> 105m/288Mi, limits 1/1Gi unchanged. `shared_buffers` is not
+  set (PostgreSQL default 128MB), well below the 288Mi request and the
+  unchanged 1Gi limit, so memory is lowered as proposed. Diff of the full
+  `forgejo-db-deploy` set: only `Cluster/forgejo-db` `spec.resources.requests`.
+  Apply: `make forgejo-db-deploy`. CNPG restarts the single instance:
+  Forgejo database outage for the restart; do it in the one-at-a-time DB
+  window with a health check after.
+- `playwright/rapp-playwright`: live source is `rapp-playwright/manifests/workload.yaml`
+  (commit `1557742` there). Request 100m/256Mi -> 65m/336Mi; CPU limit 1 -> 2
+  (throttle rule: new limit = max(2x current, 1000m); 2000m is 32x the 7d
+  peak 62.7m). Server-side diff with field manager `rapp-playwright` (the live
+  owner): only the three resource keys (NetworkPolicy: generation bump only).
+  **Drift:** the repo's `make deploy` used the default field manager and would
+  conflict on these fields; the Makefile now passes `--field-manager=rapp-playwright`.
+  Apply (local kubectl): `make -C rapp-playwright render IMAGE_REFERENCE=<live digest>`
+  then `kubectl apply --server-side --field-manager=rapp-playwright -f rapp-playwright/.rendered/workload.yaml`.
+  Strategy Recreate: the playwright pod is down for the restart (internal service only).
+
 Rollback: revert the source commit and re-sync/re-apply; the before values in the table above are the rollback target. Keep before/after `kubectl get -o yaml` captures as the receipt.