ClusterSecretStore RBAC model for multi-tenant shards

[patrick-hermann-sva]

Parent: #111

ClusterSecretStore is cluster-scoped → anything in the control plane can pull from it unless RBAC restricts ExternalSecret creation.

Design

• Per-shard ClusterSecretStore naming convention
• RBAC restricting ExternalSecret creation to platform-team namespaces
• Vault policies scoped per shard (vSphere creds only readable by vm-control-plane, etc.)
• PushSecret target paths in Vault KV v2 isolated per shard

Deliverable

RBAC manifests + Vault policy templates in this repo.