Allocate sitting-requester CCR pair and record operator gates.

CCR-2026-0026/0027 are proposed source only: new KV path, no apply,
and no widening of 0024/0025. Record destroy-after-confirm for the
npm duplicate, coordinated 0018 disablement, blocked historical
NetKingdom paths, and no Forgejo retention cutover.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a

argocd/platform-addons/openbao-secretstore/sitting-requester.yaml

@@ -0,0 +1,47 @@
+# CCR-2026-0026 (INFD-WP-0002, RPF-WP-0042). Source only. Do not apply from this
+# file. KeyCape env KEYCAPE_INFORMED_DECISION_SITTING_REQUESTER_CLIENT_SECRET
+# uses Kubernetes Secret key client-secret; OpenBao field is CLIENT_SECRET.
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-keycape-informed-decision-sitting-requester
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+    app.kubernetes.io/name: keycape
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets-keycape-informed-decision-sitting-requester
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets
+  conditions:
+  - namespaces:
+    - sso
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: keycape-informed-decision-sitting-requester-client
+  namespace: sso
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-keycape-informed-decision-sitting-requester
+  target:
+    name: keycape-informed-decision-sitting-requester-client
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  data:
+  - secretKey: client-secret
+    remoteRef:
+      key: workloads/informed-decision/sitting-requester
+      property: CLIENT_SECRET