Approve CCR-2026-0005, apply delegated OpenBao metadata, seed the KV path, verify ExternalSecret delivery on Railiance01, and complete RAILIANCE-WP-0011-T02.
Introduce external-secrets-forgejo policy/role, ClusterSecretStore openbao-forgejo (forgejo namespace), and make openbao-configure-external-secrets-forgejo.