NK-WP-0056-T10: wait for OpenBao reachability before the first login

First live journey Job was refused at setup (URLError). netcheck showed every
connection refused at 0 s and open from 3 s: k3s applies NetworkPolicy to a
new pod a moment late. Both CLI modes now poll OpenBao's unauthenticated
sys/health for up to 30 s before logging in; only connection errors retry.
48 executor tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

docs/evidence/2026-10-31-nk56-t10-journey-only/README.md

@@ -22,3 +22,14 @@ token that holds only the journey-read policy:
 
 `all_met: true`, `no_values_in_report: true`. This is T10's fail-closed proof. The unattended live run is the
 rapp's `make journey`.
+
+## First live attempt and the startup race (2026-10-31)
+
+- `make journey` (Job `bounded-executor-journey-20261031-192708`) was refused at setup with `URLError`. The OpenBao
+  login did not connect, so nothing was read or changed.
+- `make netcheck` (rapp `5fe1a70`) ran a read-only pod with the executor's labels. At 0 s, OpenBao, KeyCape and
+  Authelia all refused connections, while DNS was fine. From 3 s on, everything answered, through 42 s.
+- Diagnosis: k3s applies NetworkPolicy to a new pod a moment after it starts. The policies themselves are correct.
+- Fix: before the first login, the executor polls OpenBao's unauthenticated `sys/health` for up to 30 s
+  (`operations.wait_reachable`). Only connection errors are retried, and any HTTP answer counts as reachable.
+  This applies to both CLI modes.