fix(velero): isolate kopia repository password

[devantler]

Motivation

• A PushSecret mirrored Velero's Kopia repository-password into the shared infrastructure/backup/* OpenBao prefix, which co-located backup ciphertext access credentials and the decryption key and thereby allowed any principal with the broad backup-read policy to decrypt backups offline.
• The change isolates the Kopia decryption key so that backup storage credentials and the repository password are not readable through the same broadly-scoped Vault policy.

Description

• Move the PushSecret target from infrastructure/backup/velero-repo to a dedicated infrastructure/velero/repo path so the Kopia password is not placed under the shared backup prefix.
• Add a dedicated Vault path secret/data/infrastructure/velero/* to the seed-write policy block so PushSecret seeding retains write access to the new, more specific location without widening the existing backup-read policy.
• Update the PushSecret comment to describe the new seed path and note the intent to avoid sharing the broadly readable backup-object credential prefix.

Testing

• Ran git diff --check and it reported no whitespace or patch errors; the check passed.
• Ran python3 scripts/validate-naming.py and python3 scripts/validate-embedded-json.py and both validations passed.
• kubectl kustomize and ksail workload validate were not executed in this environment because kubectl and ksail are not installed, so a full schema-aware ksail validation was not performed here.

---

Codex Task

[devantler]

Requested by the 🤖 Daily AI Engineer — CI is green at the current head and this draft carries no qualifying review, so requesting the lane-priority reviewer. Hygiene only: this is a sibling lane's draft and its owner promotes it.

[devantler]

@cursor review

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_f5cf639b-3269-441e-a310-25a4a7bc14dd)

[devantler]

🤖 Generated by the Agentic Engineer

Static exact-head review of 222643b4c550cb8683be77aa36d60c6543cc541f; the branch was not checked out or executed.

[devantler]

🤖 Generated by the Agentic Engineer

[P1] Remove the old Vault key after copying it

Changing remoteKey makes ESO start writing the repository password at the new path, but a PushSecret does not migrate or delete the existing KV-v2 entry at infrastructure/backup/velero-repo. On the existing production OpenBao instance, that old entry therefore remains readable through the broad infra-backup-readonly policy, so the backup decryption key is still exposed to the audience this change intends to remove. Add an explicit one-time migration that verifies the new copy and then permanently removes the old key's versions and metadata before treating the isolation as complete.

Reviewed at 222643b4c550cb8683be77aa36d60c6543cc541f.