Migrate reuse-surface hub token lane to OpenBao handoff

RAILIANCE-WP-0011-T03: point reuse-surface-hub-write-token catalog,
playbook, and tests at bao kv get on platform/workloads/reuse/reuse-surface/runtime-secrets;
kubectl documented as break-glass only.

tests/test_routing.py

@@ -288,8 +288,8 @@ def test_reuse_surface_hub_write_token_lane_is_resolvable():
     e = catalog.get("reuse-surface-hub-write-token")
     assert e is not None and e.is_active and e.exec_capable
     assert e.resolvable is True
-    assert e.owner_repo == "reuse-surface"
-    assert "reuse-surface-env" in e.fetch_command
+    assert e.owner_repo == "railiance-platform"
+    assert "platform/workloads/reuse/reuse-surface/runtime-secrets" in e.fetch_command
 
 
 def test_find_object_storage_sts():