retarget: T04 backup key is resource-control, not Barman

Handle becomes secret:railiance-platform/backup. IAM application is
resource-control; policy and API key are Scoped backup access.

docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md

@@ -15,7 +15,7 @@ Object Storage policy attached, list/get succeeded. Private bucket
 owner-only. Live attributes are in
 `reef-storage/substrate/object-stores/platform-audit-storage.yaml`.
 Founder set a Scaleway billing alert (email). Scaleway has no euro
-hard-stop that refuses usage; that gap is accepted. Scoped Barman key
+hard-stop that refuses usage; that gap is accepted. Scoped backup key
 is T04.
 
 ## Recommendation
@@ -61,7 +61,7 @@ workload.
 - Cost alert: on the Scaleway project  
 - Owner in inventory: `resource-control`  
 - Attribute home: `reef-storage/substrate/object-stores/platform-audit-storage.yaml`  
-- Credential home (after T04): `secret:railiance-platform/platform-pg-backup-s3`  
+- Credential home (after T04): `secret:railiance-platform/backup`  
 - Consumer potential: `rapp-postgres`  
 - Consumer actual: none until WAL flows  
 

docs/operational-reference-convention.md

@@ -67,7 +67,7 @@ secret:<custody_repo>/<secret_id>
 Example already named by the backup split:
 
 ```text
-secret:railiance-platform/platform-pg-backup-s3
+secret:railiance-platform/backup
 ```
 
 The handle may also record `broker` (`openbao`) and `rotation` as non-secret
@@ -92,9 +92,9 @@ When a record needs more than a string:
 {
   "kind": "credential_handle",
   "custody_repo": "railiance-platform",
-  "secret_id": "platform-pg-backup-s3",
+  "secret_id": "backup",
   "broker": "openbao",
-  "ref": "secret:railiance-platform/platform-pg-backup-s3"
+  "ref": "secret:railiance-platform/backup"
 }
 ```