Activate reuse-surface runtime secrets OpenBao lane (CCR-2026-0005)

Approve CCR-2026-0005, apply delegated OpenBao metadata, seed the KV path,
verify ExternalSecret delivery on Railiance01, and complete RAILIANCE-WP-0011-T02.

argocd/platform-addons/openbao-secretstore/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - openbao.clustersecretstore.yaml
   - openbao-activity-core.clustersecretstore.yaml
   - openbao-forgejo.clustersecretstore.yaml
+  - openbao-reuse.clustersecretstore.yaml

argocd/platform-addons/openbao-secretstore/openbao-reuse.clustersecretstore.yaml

@@ -0,0 +1,28 @@
+# Interim: reuse-surface on railiance01 reads runtime secrets from coulombcore OpenBao
+# (https://bao.coulomb.social) until railiance01 OpenBao is bootstrapped (Wave 7).
+#
+# Prereq: Secret external-secrets/openbao-reuse-eso-token (key: token) with a
+# policy-limited OpenBao token that can read
+# platform/workloads/reuse/reuse-surface/runtime-secrets.
+# Bootstrap: railiance-apps make reuse-openbao-eso-token-apply
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-reuse
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+spec:
+  provider:
+    vault:
+      server: https://bao.coulomb.social
+      path: platform
+      version: v2
+      auth:
+        tokenSecretRef:
+          name: openbao-reuse-eso-token
+          namespace: external-secrets
+          key: token
+  conditions:
+    - namespaces:
+        - reuse