RPF-WP-0046: periodic ESO database tokens and a daily renewer

The five dynamic-database ClusterSecretStores use 768h static tokens that
nothing renews; expiry revoked their DB leases on 2026-09-23 and recurs
around 2026-10-25. Kubernetes auth is not a drop-in fix: ESO v0.16.1 revokes
its login token after each reconcile, which revokes the leases it created.

- eso-token-renewer CronJob (ArgoCD draft, no RBAC, mounted Secrets).
- Attended periodic mint script for all five lanes.
- CronJob added to the platform-addons AppProject in git (not yet applied).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

argocd/platform-addons/eso-token-renewer/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# RPF-WP-0046. Read only by the railiance01 Application in
+# argocd/railiance01/drafts/eso-token-renewer.application.yaml. No coulombcore
+# Application points here.
+
+namespace: external-secrets
+
+resources:
+  - cronjob.yaml
+
+configMapGenerator:
+  - name: eso-token-renewer-worker
+    files:
+      - renew.py