Register secrets-engine-openbao live and fold its env binding in (NK-WP-0046-T03)

Founder live go caafe4be. Config resourceVersion 71471711 -> 71655453 with only
this client added; KeyCape restarted on the kept image 6f79a2af.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b

sso-mfa/k8s/keycape/deployment.yaml

@@ -63,6 +63,12 @@ spec:
               protocol: TCP
 
           env:
+            # secrets-engine-openbao service client (NK-WP-0046, live go caafe4be, 2026-10-07).
+            - name: KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: keycape-secrets-engine-openbao-client
+                  key: client-secret
             - name: KEYCAPE_POLICY_PATH
               value: /var/lib/keycape-policy/policy.json
             - name: KEYCAPE_ACCOUNT_PORTAL_URL

sso-mfa/k8s/keycape/test_secrets_engine_openbao_client_rollout.py

@@ -134,10 +134,13 @@ class DeploymentBindingTests(unittest.TestCase):
         container = patch['spec']['template']['spec']['containers'][0]
         self.assertEqual(container, {'name': 'keycape', 'env': [module.ENV_BINDING]})
 
-    def test_live_deployment_yaml_does_not_yet_bind(self):
+    def test_deployment_yaml_binds_exactly_once_after_live_go(self):
+        # Folded in under live go caafe4be (2026-10-07).
         docs = yaml.safe_load_all(Path(__file__).with_name('deployment.yaml').read_text())
         dep = next(d for d in docs if d and d.get('kind') == 'Deployment')
-        self.assertFalse(module.deployment_binding(dep))
+        self.assertTrue(module.deployment_binding(dep))
+        env = dep['spec']['template']['spec']['containers'][0]['env']
+        self.assertEqual([e['name'] for e in env].count(module.ENV_NAME), 1)
 
     def test_binding_detection_and_drift(self):
         self.assertTrue(module.deployment_binding(self.deployment([module.ENV_BINDING])))

workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md

@@ -65,7 +65,7 @@ image `sha256:6f79a2af…c496b8` (KeyCape source 1164f65). No image change.
 
 ```task
 id: NK-WP-0046-T03
-status: wait
+status: done
 priority: high
 needs_human: true
 decision_id: caafe4be-4f68-47b4-9567-316d47b94992
@@ -81,3 +81,10 @@ observed uid/resourceVersion, restart, then hand to KEY-WP-0037-T04 for native
 issuance, wrong-secret/excess-scope denial and existing human-login checks.
 Rollback: `--operation remove`, restart, remove the env binding. Fold the
 binding into `deployment.yaml` in the same change that records the go.
+
+**Done 2026-10-07 under live go `caafe4be`.** The env binding was patched first
+(9 to 10 env names, server dry run first), then the exact-match apply ran.
+`sso/keycape-config` went from resourceVersion 71471711 to 71655453 (uid 2e94519d…),
+`changed: true`, `unrelated_config_bytes_preserved: true`, `values_emitted: false`.
+KeyCape restarted and rolled out on image `sha256:6f79a2af…`. The binding is folded
+into `deployment.yaml`. Live issuance checks are KEY-WP-0037-T04.