Activate NK-WP-0009/0011; add tutorials slice and proposed ADR-0009

- docs/tutorials: template, OpenBao and SSH tutorials (unexercised)
- tools/tutorial-verify + make tutorials-verify (NK-WP-0009-T06)
- ADR-0009 proposed: expanded-mode Keycloak trigger and topology

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

tools/tutorial-verify/tests/test_tutorial_verify.py

@@ -0,0 +1,48 @@
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+import tutorial_verify as tv  # noqa: E402
+
+ROOT = Path(__file__).resolve().parents[3]
+GOOD = (ROOT / "docs/tutorials/TEMPLATE.md").read_text()
+
+
+def write(tmp_path, text):
+    p = tmp_path / "t.md"
+    p.write_text(text)
+    return p
+
+
+def test_real_tutorials_pass():
+    for p in (ROOT / "docs/tutorials").glob("*.md"):
+        if p.name in ("README.md", "TEMPLATE.md"):
+            continue
+        assert tv.check(p, ROOT) == [], p.name
+
+
+def test_missing_status(tmp_path):
+    errs = tv.check(write(tmp_path, GOOD.replace("Exercise status: unexercised\n", "")), ROOT)
+    assert any("Exercise status" in e for e in errs)
+
+
+def test_missing_rollback(tmp_path):
+    errs = tv.check(write(tmp_path, GOOD.replace("## Rollback", "## Other")), ROOT)
+    assert "missing section: Rollback" in errs
+
+
+def test_step_without_owner(tmp_path):
+    errs = tv.check(write(tmp_path, GOOD.replace("**[owner: <repo>]** ", "")), ROOT)
+    assert any("owner tag" in e for e in errs)
+
+
+def test_secret_marker(tmp_path):
+    errs = tv.check(write(tmp_path, GOOD + "\nhvs.ABCDEFGHIJKLMNOP\n"), ROOT)
+    assert "contains secret-looking marker" in errs
+
+
+def test_retired_endpoint_and_missing_path(tmp_path):
+    txt = GOOD + "\nOpen https://bao.coulomb.social now. See `docs/nope.md`.\n"
+    errs = tv.check(write(tmp_path, txt), ROOT)
+    assert any("bao.coulomb.social" in e for e in errs)
+    assert "references missing path: docs/nope.md" in errs