Document reuse-surface webhook secret in hub token playbook

Note the sibling REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET key, Forgejo webhook
rollout command, and the RAILIANCE-WP-0011 OpenBao migration backlog item.

wiki/playbooks/reuse-surface-hub-write-token.md

@@ -26,6 +26,24 @@ secret that backs the hub Deployment.
 This is **not** an OpenBao KV path. The token is generated at deploy time and
 stored only in the Kubernetes Secret consumed by the `reuse-surface` workload.
 
+### Related key in the same Secret
+
+| Field | Purpose |
+| --- | --- |
+| `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` | HMAC for `POST /v1/webhooks/forgejo`; must match the org webhook on Forgejo |
+
+Fetch (same kubectl lane — never paste into chat):
+
+```bash
+kubectl --kubeconfig ~/.kube/config-hosteurope get secret reuse-surface-env -n reuse \
+  -o jsonpath='{.data.REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET}' | base64 -d
+```
+
+Forgejo org webhook rollout: `railiance-apps` `make reuse-forgejo-webhook`
+(runbook `docs/reuse-surface-on-railiance01.md#forgejo-org-webhook`).
+
+Planned OpenBao migration: **RAILIANCE-WP-0011** (`railiance-platform`).
+
 ---
 
 ## Worker checklist