fix(security): prevent ESO copying source annotations (CUST-WP-0073)

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da

manifests/factory-audit-senders.yaml

@@ -37,6 +37,12 @@ spec:
     kind: ClusterSecretStore
     name: openbao-approval-engine-audit
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        annotations:
+          railiance.io/credential-change: CCR-2026-0021
+          railiance.io/admission: approved
     name: approval-engine-audit
     creationPolicy: Owner
     deletionPolicy: Retain
@@ -84,6 +90,12 @@ spec:
     kind: ClusterSecretStore
     name: openbao-informed-decision-audit
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        annotations:
+          railiance.io/credential-change: CCR-2026-0022
+          railiance.io/admission: approved
     name: informed-decision-audit
     creationPolicy: Owner
     deletionPolicy: Retain

manifests/keycape-factor-custody.yaml

@@ -52,6 +52,11 @@ spec:
     kind: ClusterSecretStore
     name: openbao-keycape-factor-read
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/part-of: net-kingdom-sso-mfa
     name: keycape-factor-read
     creationPolicy: Owner
   data: