Add audit-core ESO policy and ClusterSecretStore for railiance01

KV store for the sender registry only. Database leases stay on the
OpenBao database engine and are consumed via VaultDynamicSecret in
audit-core. Not added to the coulombcore ArgoCD kustomization.

argocd/platform-addons/openbao-secretstore/openbao-audit-core.clustersecretstore.yaml

@@ -0,0 +1,33 @@
+# audit-core sender-registry store. Deploy on railiance01 (not the
+# coulombcore ArgoCD kustomization — same interim pattern as
+# openbao-email-connect / openbao-activity-core).
+#
+# Prereq: Secret external-secrets/openbao-audit-core-eso-token (key: token)
+# with policy external-secrets-audit-core. Bootstrap:
+#   audit-core/scripts/openbao-eso-token-apply.sh
+#
+# Database leases are *not* served by this store. They are OpenBao database
+# engine credentials and are vended by VaultDynamicSecret in the audit-core
+# package (deploy/vaultdynamicsecrets.yaml).
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-audit-core
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+    app.kubernetes.io/name: audit-core
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        tokenSecretRef:
+          name: openbao-audit-core-eso-token
+          namespace: external-secrets
+          key: token
+  conditions:
+    - namespaces:
+        - audit-core