NK-WP-0048: run keycape check-config before any registry patch

keycape-client.py --check-config runs KeyCape's startup checks (key-cape
c528daa) on the live and proposed registry via stdin; apply refuses a
registry KeyCape would refuse at start. Type 1.1 patch names the option.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 736651@bnt-lap001
Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8

security-case-types/oidc-browser-relying-party/README.md

@@ -129,6 +129,9 @@ uses them.
 
 ## History
 
+- **1.1 patch** (2026-10-10): `register-client` runs `keycape check-config`
+  (key-cape c528daa) through `keycape-client.py --check-config` on the live and
+  the proposed registry; apply refuses a registry KeyCape would refuse at start.
 - **1.1** (2026-10-10, minor): verification `consumer-enforces-groups`, and
   hand-over requires the consumer to enforce `access_groups`, because KeyCape has
   no per-client group gate (key-cape type review R2, key-cape 6038483). No new

security-case-types/oidc-browser-relying-party/type.yaml

@@ -219,7 +219,7 @@ spec:
         closed if the binding is missing.
     - id: register-client
       owner: net-kingdom
-      entry_point: "sso-mfa/k8s/keycape/keycape-client.py apply --client-file <client-from-case> --case-acceptance <record> (net-kingdom.keycape-client-registration)"
+      entry_point: "sso-mfa/k8s/keycape/keycape-client.py apply --client-file <client-from-case> --case-acceptance <record> --check-config <keycape binary> (net-kingdom.keycape-client-registration)"
       auth: "operator write access to the live KeyCape client registry in namespace sso"
       lane: key-cape-oidc-login
       warden_executes: false
@@ -234,8 +234,10 @@ spec:
         at startup and keeps login, authorization and handoff state in memory, so
         the restart drops in-flight logins and sessions for every client; runs go
         in a quiet window (key-cape type review R4). The rendered registry must
-        pass KeyCape's own client validation before the restart: a refused entry
-        stops the single replica and every client loses sign-in (R1).
+        pass KeyCape's own startup checks (keycape check-config, key-cape
+        c528daa, which keycape-client.py runs before it patches) before the
+        restart: a refused entry stops the single replica and every client
+        loses sign-in (R1).
     - id: hand-over
       owner: "{consumer_owner_repo}"
       entry_point: "configure {consuming_service} with issuer {issuer}, client {client_id} and custody bao:platform/workloads/keycape/{client_id}, and make it require one of {access_groups} in the groups claim before sign-in completes"