feat: prepare core hub platform onboarding

argocd/platform-addons/openbao-secretstore/openbao-core-hub-runtime.clustersecretstore.yaml

@@ -0,0 +1,30 @@
+# CCR-2026-0013. Railiance01-local OpenBao Kubernetes-auth store for the
+# standing Core Hub protected-API token. Dynamic PostgreSQL leases use a
+# separate database-mount store owned with the rapp-core-hub consumer package.
+#
+# Do not apply until CCR approval and confirmation of the
+# external-secrets-core-hub-runtime Kubernetes auth role.
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-core-hub-runtime
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+    app.kubernetes.io/name: core-hub
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets-core-hub-runtime
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets
+  conditions:
+    - namespaces:
+        - core-hub