Prepare scoped factory audit custody and enforce receiver compatibility

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

manifests/factory-audit-senders.yaml

@@ -0,0 +1,94 @@
+# CCR-2026-0021/0022. Review only; no credentials or namespaces.
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-approval-engine-audit
+  annotations:
+    railiance.io/credential-change: CCR-2026-0021
+    railiance.io/admission: proposed
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets-approval-engine-audit
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets
+  conditions:
+  - namespaces:
+    - approval-engine
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: approval-engine-audit
+  namespace: approval-engine
+  annotations:
+    railiance.io/credential-change: CCR-2026-0021
+    railiance.io/admission: proposed
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-approval-engine-audit
+  target:
+    name: approval-engine-audit
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  data:
+  - secretKey: audit-token
+    remoteRef:
+      key: workloads/approval-engine/audit-sender
+      property: AUDIT_TOKEN
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-informed-decision-audit
+  annotations:
+    railiance.io/credential-change: CCR-2026-0022
+    railiance.io/admission: proposed
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets-informed-decision-audit
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets
+  conditions:
+  - namespaces:
+    - informed-decision
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: informed-decision-audit
+  namespace: informed-decision
+  annotations:
+    railiance.io/credential-change: CCR-2026-0022
+    railiance.io/admission: proposed
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-informed-decision-audit
+  target:
+    name: informed-decision-audit
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  data:
+  - secretKey: token
+    remoteRef:
+      key: workloads/informed-decision/audit-sender
+      property: AUDIT_TOKEN