Activate NK-WP-0009/0011; add tutorials slice and proposed ADR-0009

- docs/tutorials: template, OpenBao and SSH tutorials (unexercised)
- tools/tutorial-verify + make tutorials-verify (NK-WP-0009-T06)
- ADR-0009 proposed: expanded-mode Keycloak trigger and topology

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

Makefile

@@ -186,6 +186,12 @@ openbao-init-unseal: ## SOPS-held OpenBao init/unseal (NET-WP-0020 T2; requires
 openbao-init-unseal-dry-run: ## Dry-run the SOPS-held OpenBao init/unseal path
 	@bash sso-mfa/bootstrap/openbao-init-unseal.sh --dry-run
 
+tutorials-verify: ## Verify docs/tutorials structure, ownership tags, and references
+	python3 tools/tutorial-verify/tutorial_verify.py
+
+tutorials-verify-test: ## Run tutorial verifier tests
+	python3 -m pytest tools/tutorial-verify/tests
+
 iam-profile-conformance-test: ## Run current IAM Profile conformance fixture tests
 	python3 -m pytest tools/iam-profile-conformance/tests
 
@@ -373,7 +379,7 @@ security-bootstrap-ui: security-bootstrap-metadata-init ## Serve local custody a
 	  --host "$(SECURITY_BOOTSTRAP_HOST)" \
 	  --port "$(SECURITY_BOOTSTRAP_PORT)"
 
-.PHONY: help hooks hooks-test sops-setup sops-edit sops-encrypt sops-decrypt sops-rotate \
+.PHONY: tutorials-verify tutorials-verify-test help hooks hooks-test sops-setup sops-edit sops-encrypt sops-decrypt sops-rotate \
         check-secrets creds-init creds-generate creds-bundle creds-apply creds-verify \
         creds-status creds-rotate \
         creds-agent-init creds-agent-status creds-emergency-reprint \