Declare key-cape.oidc-client-registration; add KEY-WP-0038-T04 entry point

Playbook capability (contract PASS, maturity planned) composed by net-kingdom's
SecurityCaseType oidc-browser-relying-party. T04 implements tools/keycape-client,
generalizing the per-client rollout helpers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012

workplans/KEY-WP-0038-forgejo-oidc-client.md

@@ -140,3 +140,32 @@ all, or receive scoped Forgejo tokens bound to a NetKingdom service identity
 
 Acceptance: evidence for all three principals; the agent and service decision is
 recorded. Then hand over to RAPPS-WP-0016.
+
+```task
+id: KEY-WP-0038-T04
+status: todo
+priority: high
+```
+
+### T04 — Implement the `keycape-client` entry point
+
+`capabilities/playbooks/key-cape.oidc-client-registration.yaml` (contract PASS,
+`maturity: planned`) declares client registration as a playbook capability, so
+that the SecurityCaseType `oidc-browser-relying-party` (net-kingdom NK-WP-0048)
+can compose it. Implement the entry point it names, `tools/keycape-client/`:
+
+- `keycape-client register --client-file <rendered-client.yaml>` with modes
+  `inspect`, `dry-run`, `apply` and `remove`; adds, updates or removes exactly one
+  client in the live registry; idempotent; never prints or writes secret values;
+  a confidential client's secret is read from its custody reference
+- one implementation replacing the per-client helpers in net-kingdom
+  `sso-mfa/k8s/keycape/` (register-coulomb-social, portal-client-rollout,
+  vergabe-client-rollout, secrets-engine-openbao-client-rollout), keeping their
+  safeguards (byte-preserving merge, compare-and-swap, cluster pin, safe receipts)
+  and their tests as regression cases
+- client field validation by the KEY-WP-0028 rules
+- then set the declaration's `maturity` to `implemented`
+
+Longer term, loading clients from a non-secret registry with secrets referenced
+from custody would remove the type's only attended step (see the type README,
+"Attended steps").