Deploy KeyCape client MFA override for coulomb-social

Register coulomb-social with mfaRequired: false, roll key-cape image that
honors client policy, and track NK-WP-0025 public registration orchestration.

sso-mfa/k8s/keycape/deployment.yaml

@@ -54,7 +54,7 @@ spec:
           # 2026-05-24: direct-imported into railiance01 k3s for the
           # bootstrap-console OIDC/MFA rollout. Use IfNotPresent while the
           # HTTP registry push/pull path is being cleaned up.
-          image: key-cape:90a2078
+          image: key-cape:mfa-client-20260809
           imagePullPolicy: IfNotPresent
 
           ports:

sso-mfa/k8s/keycape/register-coulomb-social.py

@@ -26,6 +26,10 @@ CLIENT = {
     "allowedScopes": ["openid", "profile", "email", "groups"],
     "grantTypes": ["authorization_code"],
     "clientType": "public",
+    # Ordinary coulomb.social sessions are AAL1 unless the client explicitly
+    # requests AAL2 through acr_values. Platform/admin clients keep their
+    # existing provider-driven mandatory MFA behavior.
+    "mfaRequired": False,
 }