Activate NK-WP-0009/0011; add tutorials slice and proposed ADR-0009

- docs/tutorials: template, OpenBao and SSH tutorials (unexercised)
- tools/tutorial-verify + make tutorials-verify (NK-WP-0009-T06)
- ADR-0009 proposed: expanded-mode Keycloak trigger and topology

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

docs/tutorials/TEMPLATE.md

@@ -0,0 +1,41 @@
+# <Tutorial title>
+
+Exercise status: unexercised
+Workplan task: NK-WP-NNNN-TNN
+Pattern(s): <canonical doc and section this teaches>
+
+## Outcome
+
+<One sentence: what is true when you are done.>
+
+## Prerequisites
+
+- <Access, tools, and state required. Name the owner of each.>
+
+## Architecture context
+
+<Who owns what. Which boundaries this crosses.>
+
+## Steps
+
+1. **[owner: <repo>]** <step and command>
+
+## Verification
+
+Done when:
+
+- <Observable, repeatable check. Command plus expected result.>
+
+## Rollback
+
+- <How to undo each step, or "not reversible" and why.>
+
+## Threat checks
+
+- <What could go wrong; what must never be logged, committed, or pasted.>
+
+## Ownership notes
+
+| Concern | Owner |
+| --- | --- |
+| <concern> | <repo> |