Define a data-preserving OpenBao audit storage lifecycle #4671

🤖 Generated by the Agentic Engineer

Describe the bug

The public OpenBao configuration documents a file audit device and a future log-shipping plan, but does not define an archival and retention implementation. Replace that future-tense guidance with a tested, data-preserving lifecycle.

Expected behavior

Audit evidence must remain available. Capacity, durable retention, and failure alerts should be explicitly defined and independently verified.

Public configuration context

The repository's OpenBao Helm values declare the file audit device and describe its storage lifecycle. OpenBao's file audit documentation recommends external rotation with SIGHUP rather than application-managed rotation.

This public issue deliberately includes no production telemetry, audit content, storage identifiers, or credential information.

Acceptance criteria

• Measure per-replica growth privately, without exposing audit content.
• Establish a reviewed, data-preserving capacity reconciliation path. Do not blindly alter immutable StatefulSet claim templates or assume requested size equals capacity.
• Define durable audit archival and retention before adding any destructive rotation or cleanup.
• Add regression coverage for capacity exhaustion and archival/rotation failure; preserve audit fail-closed behavior and existing security checks.
• Validate through exact-head review, CI, protected deployment, and repeated live storage readback.
• Replace the documented growth estimate with a measurement procedure and document the deployed recovery procedure.

This is separate from the server-recreation repair in #4653 and standby OIDC adoption in #4391. Do not suppress the disk warning or delete audit evidence to make the counters clean.