feat(ql3): add direct Vault KV worker secret custody

deploy/kubernetes/ql3-cluster/vault-kv-worker-secret/credentials.example.yaml

@@ -0,0 +1,20 @@
+# Create these objects through the deployment's Secret authority; do not commit
+# real CA or token material. The Vault token must be an orphan, non-renewable
+# service token with only ql3-worker-secret-read and at most a 15-minute TTL.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-cluster-worker-vault-trust
+  namespace: qinglong3-system
+type: Opaque
+stringData:
+  ca.pem: REPLACE_WITH_PRIVATE_VAULT_CA_PEM
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-cluster-worker-vault-auth
+  namespace: qinglong3-system
+type: Opaque
+stringData:
+  token: REPLACE_WITH_SHORT_LIVED_ORPHAN_VAULT_TOKEN