Add email-connect transactional SMTP and ingest custody lane.

CCR-2026-0010, OpenBao read policies, ClusterSecretStore openbao-email-connect,
and workload-kv lane documentation for EMAIL-WP-0004-T03.

docs/workload-kv-access-lanes.md

@@ -460,3 +460,59 @@ unattended principal.
 
 Playbook: `ops-warden/wiki/playbooks/agent-harness-secrets.md`.
 
+
+## email-connect transactional SMTP + ingest token (`CCR-2026-0010`)
+
+IONOS STARTTLS credentials and the shared user-engine ingest bearer for the
+`email-connect` transactional invitation/verification receiver on railiance01.
+
+| Item | Value |
+| --- | --- |
+| CCR | `CCR-2026-0010-email-connect-transactional` |
+| KV mount | `platform` |
+| OpenBao CLI path | `platform/workloads/email-connect/transactional` |
+| Fields | `EMAIL_CONNECT_INGEST_TOKEN`, `EMAIL_CONNECT_SMTP_USERNAME`, `EMAIL_CONNECT_SMTP_PASSWORD` |
+| Operator read policy | `workload-kv-read-email-connect-transactional` |
+| Policy file | `openbao/policies/workload-kv-read-email-connect-transactional.hcl` |
+| ESO policy | `external-secrets-email-connect` |
+| ESO policy file | `openbao/policies/external-secrets-email-connect.hcl` |
+| K8s auth role | `external-secrets-email-connect` (ESO delivery) |
+| ClusterSecretStore | `openbao-email-connect` (namespace `email-connect` only) |
+| Primary consumer | ExternalSecret `email-connect/email-connect-runtime` → Secret `email-connect-runtime` |
+| Package manifests | `email-connect/deploy/k8s/railiance/` |
+| ops-warden catalog | `email-connect-transactional` (draft until front door verified) |
+
+Non-secret SMTP host/port/sender and portal URL stay in ConfigMap
+`email-connect-config` (not in OpenBao).
+
+Operator provision (attended; values from mode-0600 files only):
+
+```bash
+bao kv put platform/workloads/email-connect/transactional \
+  EMAIL_CONNECT_INGEST_TOKEN=@file \
+  EMAIL_CONNECT_SMTP_USERNAME=@file \
+  EMAIL_CONNECT_SMTP_PASSWORD=@file
+```
+
+Fetch for operator smoke only (do not log values):
+
+```bash
+bao kv get -field=EMAIL_CONNECT_SMTP_USERNAME \
+  platform/workloads/email-connect/transactional
+```
+
+Or via ops-warden after catalog promotion:
+
+```bash
+warden access email-connect-transactional --exec -- \
+  sh -lc 'test -n "$EMAIL_CONNECT_SMTP_PASSWORD"'
+```
+
+**Consumer facts:**
+
+- user-engine must hold the **same** ingest token under its own runtime secret;
+  it must never receive `EMAIL_CONNECT_SMTP_*`.
+- NetworkPolicy in the package admits only `user-engine` to TCP 8080 and egress
+  only DNS + TCP 587.
+- Rotation is overlap-first for both SMTP password and ingest token; roll both
+  email-connect and user-engine after ESO refresh when the bearer changes.