Prepare bounded Kubernetes authentication recovery for three ESO lanes

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml

@@ -1,8 +1,4 @@
-# Forgejo reads SMTP credentials from the private railiance01 OpenBao service.
-#
-# Prereq: Secret external-secrets/openbao-forgejo-eso-token (key: token) with a
-# policy-limited OpenBao token that can read platform/workloads/forgejo/forgejo-mailer.
-# Bootstrap: railiance-apps make forgejo-openbao-eso-token-apply
+# RPF-WP-0037: exact namespace/SA/audience Kubernetes auth; no static token.
 apiVersion: external-secrets.io/v1beta1
 kind: ClusterSecretStore
 metadata:
@@ -17,10 +13,14 @@ spec:
       path: platform
       version: v2
       auth:
-        tokenSecretRef:
-          name: openbao-forgejo-eso-token
-          namespace: external-secrets
-          key: token
+        kubernetes:
+          mountPath: kubernetes
+          role: forgejo-mailer-eso
+          serviceAccountRef:
+            name: forgejo-mailer-eso
+            namespace: forgejo
+            audiences:
+            - openbao
   conditions:
-    - namespaces:
-        - forgejo
+  - namespaces:
+    - forgejo