Add email-connect transactional SMTP and ingest custody lane.

CCR-2026-0010, OpenBao read policies, ClusterSecretStore openbao-email-connect,
and workload-kv lane documentation for EMAIL-WP-0004-T03.

argocd/platform-addons/openbao-secretstore/openbao-email-connect.clustersecretstore.yaml

@@ -0,0 +1,32 @@
+# email-connect transactional receiver reads SMTP + ingest token from OpenBao.
+# Deploy on railiance01 (not coulombcore ArgoCD kustomization — same interim
+# pattern as openbao-activity-core / openbao-reuse).
+#
+# Prereq: Secret external-secrets/openbao-email-connect-eso-token (key: token)
+# with policy external-secrets-email-connect (or
+# workload-kv-read-email-connect-transactional) able to read
+# platform/workloads/email-connect/transactional.
+# Bootstrap: email-connect/deploy/k8s/railiance/openbao-eso-token-apply.sh
+# CCR: CCR-2026-0010
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-email-connect
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+    app.kubernetes.io/name: email-connect
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        tokenSecretRef:
+          name: openbao-email-connect-eso-token
+          namespace: external-secrets
+          key: token
+  conditions:
+    - namespaces:
+        - email-connect