Switch openbao-activity-core ClusterSecretStore to interim coulombcore token auth like forgejo/reuse, broaden the activity-core ESO policy to include the shared issue-core runtime path, and document ESO-managed rotation.