One cluster route (NK_KUBECONFIG, default ~/.kube/config-railiance01) and
server-side apply throughout. Fixes the Makefile dry-run defaulting to the
coulombcore kubeconfig. Lane-run scripts take no default and fail closed when
NK_KUBECONFIG is unset. net-kingdom convention lint: 14 findings -> 0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 73091@bnt-lap001
Assistant-Session: 9f48906c-6737-449f-8b97-fb86877ca59a
Public bao.coulomb.social was retracted today and now presents
Traefik's default certificate. Login must use http://127.0.0.1:18200
via openbao-attended-exec.py, matching the sitting-requester path.
Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
warden access runs OIDC from the caller environment. Putting BAO_ADDR
only on the child env argv leaves bao login talking to the wrong
address, which fails before command handoff.
Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
