Admit KeyCape approval-engine client custody paths and delivery

Answers KEY-WP-0013-T02. Both proposed KV paths are confirmed unchanged; the
field name is corrected to CLIENT_SECRET for the platform uppercase convention
and the CCR validator. Kubernetes delivery references are confirmed against the
live sso namespace. Attended authority is the governed openbao-platform-admin-login
lane, and the rollout is one attended window ordered after the Authelia issuer
precondition.

Adds CCR-2026-0017/0018, two exact-path read policies, two namespace-limited
ClusterSecretStores with Kubernetes auth, two ExternalSecrets, and RPF-WP-0035-T05.
Nothing is applied and no value exists: both CCRs remain proposed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1275505@bnt-lap001
Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5

argocd/platform-addons/openbao-secretstore/keycape-approval-clients.externalsecrets.yaml

@@ -0,0 +1,48 @@
+# CCR-2026-0017 / CCR-2026-0018 (KEY-WP-0013-T02, RPF-WP-0035-T05).
+# KeyCape-side delivery of the two approval-engine confidential client secrets.
+# The Kubernetes Secret key stays client-secret to match the live
+# KEYCAPE_RAPP_QONTO_CLIENT_SECRET secretKeyRef shape; the OpenBao field is
+# CLIENT_SECRET because KV field names are uppercase by platform convention.
+#
+# Apply only after the stores sync and inside the agreed attended rollout window;
+# the KeyCape image that reads both environment names rolls out after these sync.
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: keycape-secrets-engine-approval-client
+  namespace: sso
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-keycape-secrets-engine-approval
+  target:
+    name: keycape-secrets-engine-approval-client
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  data:
+    - secretKey: client-secret
+      remoteRef:
+        key: workloads/secrets-engine/approval-client
+        property: CLIENT_SECRET
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: keycape-approval-engine-operator-client
+  namespace: sso
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-keycape-approval-engine-operator
+  target:
+    name: keycape-approval-engine-operator-client
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  data:
+    - secretKey: client-secret
+      remoteRef:
+        key: workloads/approval-engine/operator-client
+        property: CLIENT_SECRET

argocd/platform-addons/openbao-secretstore/openbao-keycape-approval-clients.clustersecretstore.yaml

@@ -0,0 +1,61 @@
+# CCR-2026-0017 / CCR-2026-0018 (KEY-WP-0013-T02, RPF-WP-0035-T05).
+# Two railiance01-local Kubernetes-auth stores for the KeyCape verifier copies of
+# the approval-engine confidential client secrets. Deliberately separate stores,
+# roles and policies so either client can be revoked without disturbing the other;
+# their scope sets differ and a shared identity would erase that boundary.
+#
+# Do not apply before both CCRs are approved and the exact-path policies and
+# Kubernetes auth roles exist. Both stores are limited to namespace sso and grant
+# no access to any other platform workload path.
+#
+# The existing sso Secret keycape-rapp-qonto-client is hand-created, not managed
+# here; adopting it is a separate migration.
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-keycape-secrets-engine-approval
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+    app.kubernetes.io/name: keycape
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets-keycape-secrets-engine-approval
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets
+  conditions:
+    - namespaces:
+        - sso
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-keycape-approval-engine-operator
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+    app.kubernetes.io/name: keycape
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets-keycape-approval-engine-operator
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets
+  conditions:
+    - namespaces:
+        - sso