Close RAILIANCE-WP-0015-T06 rapp credential-lane binding

Document the one recipe a new rapp uses to acquire runtime secrets:
standing KV secrets bind through a CCR target.rapp, leases through
grant rapp_id. Stamp the existing postgres grants and the qonto
workload CCR. Gate, delivery, and revocation are unchanged.

scripts/credential-change.py

@@ -63,6 +63,7 @@ FRONTDOOR_READINESS = {
     "compromised",
 }
 SAFE_ID_RE = re.compile(r"^[A-Z0-9][A-Z0-9_.-]*$")
+RAPP_SLUG_RE = re.compile(r"^rapp-[a-z0-9]+(-[a-z0-9]+)*$")
 TTL_RE = re.compile(r"^[1-9][0-9]*[smhd]$")
 LOWER_SAFE_ID_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
 FIELD_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*$")
@@ -191,6 +192,10 @@ def validate_workload_kv_read(ccr: dict[str, Any], errors: list[str], warnings:
     target = require_object(ccr.get("target"), "target", errors)
     for field in ("domain", "tenant", "workload", "environment", "purpose"):
         require_string(target.get(field), f"target.{field}", errors)
+    rapp = target.get("rapp")
+    if rapp is not None:
+        if not isinstance(rapp, str) or not RAPP_SLUG_RE.match(rapp):
+            errors.append("target.rapp must be a rapp-* slug when set")
 
     openbao = require_object(ccr.get("openbao"), "openbao", errors)
     mount = require_string(openbao.get("mount"), "openbao.mount", errors)