Add keycape check-config; reject duplicate clientIds

net-kingdom asked for a way to validate a rendered configuration before
keycape-client.py restarts KeyCape (oidc-browser-relying-party review R4).
check-config runs every startup check that needs no secret, key or upstream:
validation, registry build, global tokenLifetime, policy-store clients and,
with --env-names, the secretRef bindings. The report carries no values.

ValidateConfig now refuses a clientId registered twice. The registry is a
map, so a duplicate silently replaced the earlier registration.

Also records the owners' amended CCR-2026-0018 sequence in KEY-WP-0013.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3

src/internal/config/validate.go

@@ -68,13 +68,20 @@ func ValidateConfig(cfg *Config) []string {
 		errs = append(errs, "clients: at least one client must be defined")
 	}
 
+	// The registry is keyed by clientId, so a duplicate would silently replace
+	// the earlier registration instead of failing.
+	seen := map[string]bool{}
+
 	// Each client must have at least one redirect URI and a non-empty clientId.
 	for i, c := range cfg.Clients {
 		prefix := fmt.Sprintf("clients[%d] (%s)", i, c.ClientID)
 		if c.ClientID == "" {
 			prefix = fmt.Sprintf("clients[%d]", i)
 			errs = append(errs, prefix+": clientId must not be empty")
+		} else if seen[c.ClientID] {
+			errs = append(errs, prefix+": clientId is registered more than once")
 		}
+		seen[c.ClientID] = true
 		if strings.TrimSpace(c.Audience) != c.Audience || strings.ContainsAny(c.Audience, " \t\r\n") {
 			errs = append(errs, prefix+": audience must be a single non-whitespace identifier")
 		}