Pin attended sender mint to the operator OpenBao tunnel

Public bao.coulomb.social was retracted today and now presents
Traefik's default certificate. Login must use http://127.0.0.1:18200
via openbao-attended-exec.py, matching the sitting-requester path.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082

scripts/diagnose-platform-admin-login.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Interactive diagnosis of the contained platform-admin OIDC login.
+# Shows bao's own messages (Warden swallows them). Stores the token only in a
+# throwaway helper, revokes it, and prints metadata — never the token.
+set -euo pipefail
+export BAO_ADDR="${BAO_ADDR:-http://127.0.0.1:18200}"
+export VAULT_ADDR="${VAULT_ADDR:-$BAO_ADDR}"
+mkdir -p "${HOME}/.warden-attended-login"
+chmod 700 "${HOME}/.warden-attended-login"
+ROOT="$(mktemp -d "${HOME}/.warden-attended-login/diag-XXXXXX")"
+chmod 700 "$ROOT"
+helper="$ROOT/.vault-token"
+cleanup() {
+  if [[ -s "$helper" ]]; then
+    HOME="$ROOT" bao token revoke -self >/dev/null 2>&1 || true
+  fi
+  rm -rf "$ROOT"
+}
+trap cleanup EXIT
+touch "$helper"
+chmod 600 "$helper"
+echo "BAO_ADDR=$BAO_ADDR"
+echo "NTPSynchronized=$(timedatectl show -p NTPSynchronized --value 2>/dev/null || echo unknown)"
+echo "isolated_home=$ROOT"
+echo "starting bao login -no-print -method=oidc -path=netkingdom role=platform-admin"
+echo "(complete the browser flow; this process must stay running for the callback)"
+set +e
+HOME="$ROOT" bao login -no-print -method=oidc -path=netkingdom role=platform-admin
+rc=$?
+set -e
+mode=$(stat -c '%a' "$helper" 2>/dev/null || echo missing)
+size=$(stat -c '%s' "$helper" 2>/dev/null || echo 0)
+echo "login_exit=$rc helper_mode=$mode helper_bytes=$size"
+if [[ "$rc" -eq 0 && "$size" -gt 0 ]]; then
+  echo "login_ok_helper_populated"
+else
+  echo "login_failed_or_helper_empty"
+fi