RAILIANCE-WP-0011-T01: propose OpenBao path platform/workloads/reuse/reuse-surface/runtime-secrets with REUSE_SURFACE_TOKEN and REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET, matching read policy, and metadata review for Railiance01 interim ESO delivery.