Deploy the secrets-manager Runway service to GKE, and switch to that new deployment. This enables OpenBao HA. Followup: de-provision secrets-manager service on Cloud Run, drop its Cloud SQL database, and clean up runbooks.