Extend external-secrets-activity-core policy notes with forgejo-admin
paths used by activity-core actcore-forgejo-admin ExternalSecret
(ACTIVITY-WP-0023-T05).
Establish proposed workload-kv-read custody for the Forgejo site-admin
PAT at platform/workloads/forgejo/forgejo-admin, sibling to forgejo-mailer.
OIDC workstation fetch mirrors the railiance-backup-offsite pattern.