RPF-WP-0047: static notice page manifests for bao.coulomb.social

Isolated namespace (Traefik-only ingress, no egress), pinned unprivileged
nginx, / -> 200 notice, every other path -> 404, letsencrypt-prod TLS,
HTTP->HTTPS redirect. Nothing proxies to OpenBao.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

argocd/platform-addons/bao-notice/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# RPF-WP-0047. Read only by argocd/railiance01/applications/bao-notice.application.yaml.
+
+resources:
+  - manifests.yaml
+
+generatorOptions:
+  disableNameSuffixHash: false
+
+configMapGenerator:
+  - name: bao-notice-conf
+    namespace: bao-notice
+    files: [default.conf]
+  - name: bao-notice-html
+    namespace: bao-notice
+    files: [index.html]