Switch openbao-activity-core ClusterSecretStore to interim coulombcore token auth like forgejo/reuse, broaden the activity-core ESO policy to include the shared issue-core runtime path, and document ESO-managed rotation.
Document OpenBao patch, ESO force-sync, hub rollout, and Forgejo webhook reconcile; extend credential-lane lifecycle for CCR-2026-0005; finish workplan.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>