Prepare bounded State Hub preflight signing lane

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

openbao/policies/agent-high-risk-boundary.hcl

@@ -107,3 +107,11 @@ path "platform/data/workloads/policy-nexus/forgejo-source-read" {
 path "platform/metadata/workloads/policy-nexus/forgejo-source-read" {
   capabilities = ["deny"]
 }
+
+# RPF-WP-0035-T04: preflight signing key is API-only.
+path "platform/data/workloads/state-hub/repository-rename-preflight" {
+  capabilities = ["deny"]
+}
+path "platform/metadata/workloads/state-hub/repository-rename-preflight" {
+  capabilities = ["deny"]
+}

openbao/policies/inputs/state-hub-preflight-boundary-baseline.sha256

@@ -0,0 +1 @@
+8cbbe133516466bd70ee412fb2214fbe3d1fe5d455f513186eb149743a30636d

openbao/policies/workload-kv-read-state-hub-rename-preflight.hcl

@@ -0,0 +1,3 @@
+path "platform/data/workloads/state-hub/repository-rename-preflight" {
+  capabilities = ["read"]
+}

openbao/state-hub-preflight/delivery.yaml

@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: state-hub-preflight-eso
+  namespace: state-hub
+automountServiceAccountToken: false
+---
+apiVersion: external-secrets.io/v1
+kind: SecretStore
+metadata:
+  name: openbao-state-hub-rename-preflight
+  namespace: state-hub
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: state-hub-rename-preflight-eso
+          serviceAccountRef:
+            name: state-hub-preflight-eso
+            audiences: [openbao]
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: state-hub-rename-preflight
+  namespace: state-hub
+spec:
+  refreshInterval: 1m
+  secretStoreRef:
+    name: openbao-state-hub-rename-preflight
+    kind: SecretStore
+  target:
+    name: state-hub-rename-preflight
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  data:
+    - secretKey: REPOSITORY_RENAME_PREFLIGHT_SECRET
+      remoteRef:
+        key: workloads/state-hub/repository-rename-preflight
+        property: REPOSITORY_RENAME_PREFLIGHT_SECRET