retarget: CCR-2026-0012 is the general backup object-store lane

Use IAM application resource-control and policy Scoped backup access.
OpenBao path is platform/workloads/railiance/backup/object-storage.
rapp-postgres keeps Secret platform-pg-backup-s3 as the first projection.

argocd/platform-addons/openbao-secretstore/openbao-backup-object-storage.clustersecretstore.yaml

@@ -1,19 +1,20 @@
 # DRAFT — CCR-2026-0012. Do not apply until the CCR is approved and the
-# KV values are real. Deploy on railiance01 (databases lives there), not
-# the CoulombCore ArgoCD kustomization.
+# KV values are real. Deploy on railiance01 (first consumer lives in
+# databases), not the CoulombCore ArgoCD kustomization.
 #
 # Prereq: ESO can authenticate to OpenBao with policy
-# workload-kv-read-platform-pg-backup-s3. Interim railiance01 identity
+# workload-kv-read-backup-object-storage. Interim railiance01 identity
 # may be AppRole or a child token; Kubernetes auth role
-# external-secrets-platform-pg-backup is the CCR-declared steady state.
+# external-secrets-backup-object-storage is the CCR-declared steady state.
+# Add further namespace conditions when another backup consumer is bound.
 apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
-  name: openbao-platform-pg-backup
+  name: openbao-backup-object-storage
   labels:
     app.kubernetes.io/part-of: railiance-gitops
     railiance-platform/component: external-secrets
-    app.kubernetes.io/name: platform-pg-backup
+    app.kubernetes.io/name: backup-object-storage
 spec:
   provider:
     vault:
@@ -23,7 +24,7 @@ spec:
       auth:
         kubernetes:
           mountPath: kubernetes
-          role: external-secrets-platform-pg-backup
+          role: external-secrets-backup-object-storage
           serviceAccountRef:
             name: external-secrets
             namespace: external-secrets