feat(forge): resolve an optional forge read credential (STATE-WP-0084-T02/T03)

Nine repositories are invisible to derivation because central may not read
them. This adds the consuming half of the credential lane MASON-WP-0003 built.

The cluster has no agent injector and no secrets-store CSI driver, so the pod
authenticates to OpenBao with a projected ServiceAccount token (audience
`openbao`, not the API server) and reads the KV path itself. `forgeRead.*`
carries coordinates only; no credential is a chart value, an image layer, or a
Kubernetes Secret.

The credential reaches git through GIT_CONFIG_* setting http.extraHeader, not
through `-c` and not through userinfo in the clone URL — both of those put the
token in the process listing. It is redacted from ForgeDeriveError, which is
logged, stored in reset outcomes, and returned over the API.

Absent stays a supported state: with no credential, or with OpenBao
unreachable, resolution returns None and public derivation runs unchanged.
Raising would turn "nine repositories are unreadable" into "the pass failed",
which is what T01 exists to prevent.

Chart default is disabled. 717 pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

deploy/railiance/apps/charts/state-hub/values.yaml

@@ -30,9 +30,34 @@ config:
   instanceRole: unknown
   instanceLabel: ""
 
+# STATE-WP-0084-T02. The OpenBao Kubernetes auth role binds to this name and
+# not to `default`, so this is load-bearing, not cosmetic.
+serviceAccount:
+  create: true
+  name: state-hub
+
 secret:
   name: state-hub-env
 
+# Forge read credential for deriving private repositories (STATE-WP-0084,
+# MASON-WP-0003). Disabled by default: a hub without it still derives every
+# public repository, so this is added capability, not a prerequisite.
+#
+# There is no agent injector and no secrets-store CSI driver on this cluster, so
+# the pod authenticates to OpenBao itself with its projected ServiceAccount
+# token and reads the KV path. Nothing here is the credential; these are only
+# coordinates. Rotating the token in OpenBao needs no chart change and no
+# redeploy.
+forgeRead:
+  enabled: false
+  openbao:
+    addr: ""
+    role: state-hub-forge-derivation
+    audience: openbao
+    expirationSeconds: 3600
+    secretPath: ""
+    secretKey: token
+
 resources:
   requests:
     cpu: 250m