docs(keycape): prepare pinned approval-client rollout and recovery

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/approval-clients-deployment.patch.yaml

@@ -0,0 +1,27 @@
+# Proposed strategic merge patch for net-kingdom's sso/keycape Deployment.
+# Apply only after the admission gates in approval-clients-rollout.md pass.
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+    rollingUpdate: null
+  template:
+    spec:
+      containers:
+        - name: keycape
+          image: forgejo.coulomb.social/coulomb/key-cape@sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611
+          env:
+            - name: KEYCAPE_SECRETS_ENGINE_APPROVAL_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: keycape-secrets-engine-approval-client
+                  key: client-secret
+            - name: KEYCAPE_APPROVAL_ENGINE_OPERATOR_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: keycape-approval-engine-operator-client
+                  key: client-secret
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8080