feat(forge): point the credential lane at the built OpenBao objects

MASON-WP-0003-T02 delivered the token on 2026-08-27, and three of its details
differ from the chart's placeholders: KV v2 puts `data/` in the read path, the
field is `FORGE_READ_TOKEN` rather than `token`, and the address matches every
existing ClusterSecretStore (`http://openbao.openbao.svc:8200`, mount
`platform`, auth mount `kubernetes`).

The projected token's audience is now optional and defaults to empty. A token
carrying an audience the auth role does not bind is rejected at TokenReview, and
the role's audience binding is not readable without a privileged session — the
four existing external-secrets roles use the API server audience, so that is the
default that can be verified to work. Setting `openbao` here narrows the token
to OpenBao alone and is worth doing once the role binds it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

deploy/railiance/apps/charts/state-hub/templates/deployment.yaml

@@ -52,7 +52,9 @@ spec:
             sources:
               - serviceAccountToken:
                   path: token
-                  audience: {{ .Values.forgeRead.openbao.audience | quote }}
+                  {{- with .Values.forgeRead.openbao.audience }}
+                  audience: {{ . | quote }}
+                  {{- end }}
                   expirationSeconds: {{ .Values.forgeRead.openbao.expirationSeconds }}
         {{- end }}
       {{- end }}
@@ -111,6 +113,8 @@ spec:
               value: {{ .Values.forgeRead.openbao.addr | quote }}
             - name: OPENBAO_K8S_ROLE
               value: {{ .Values.forgeRead.openbao.role | quote }}
+            - name: OPENBAO_K8S_AUTH_MOUNT
+              value: {{ .Values.forgeRead.openbao.authMount | quote }}
             - name: OPENBAO_K8S_TOKEN_PATH
               value: /var/run/secrets/openbao/token
             - name: FORGE_READ_SECRET_PATH