Add cnpg-option-a-backup JSON runner, vendored static age, kubectl install helper, and ESO policy path for offsite lane so railiance01 workers can upload without workstation OIDC (RAILIANCE-WP-0016).
