Add NK-WP-0044 and NetKingdom runbook packs (legacy console wrapper, SSH pack)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md

@@ -0,0 +1,93 @@
+---
+id: NK-WP-0044
+type: workplan
+title: "Provide NetKingdom runbook packs for the runbook-tutorials engine"
+domain: infotech
+repo: net-kingdom
+status: active
+flavor: implementation
+owner: claude
+topic_slug: netkingdom
+created: "2026-09-29"
+updated: "2026-09-29"
+related: [NK-WP-0009]
+---
+
+The guided console invented here (NET-WP-0016) now has a home: the
+`runbook-tutorials` repository (workplans `RBT-WP-0002` to `RBT-WP-0006`). This
+workplan is net-kingdom's side: keep the existing console working, and offer
+NetKingdom runbooks as packs in `runbooks/`, following `runbook-pack/v0.1`.
+
+## Wrap the existing console as a legacy pack
+
+```task
+id: NK-WP-0044-T01
+status: done
+priority: high
+```
+
+`runbooks/security-bootstrap-console/pack.yaml`, engine `legacy-command`. Verified
+end to end: `rtut launch` starts `make security-bootstrap-ui`, port 8876
+answers, and the process stops on exit. The console itself is unchanged.
+
+## Convert the SSH certificate tutorial to a native pack
+
+```task
+id: NK-WP-0044-T02
+status: done
+priority: high
+```
+
+`runbooks/ssh-certificates/pack.yaml` (parameters actor, pubkey, tunnel; owner-tagged
+steps; verify and rollback). It validates; it is `unexercised`.
+
+## Convert the OpenBao and flex-auth tutorials
+
+```task
+id: NK-WP-0044-T03
+status: todo
+priority: high
+```
+
+`docs/tutorials/openbao-operating-path.md` and `protected-system-flex-auth.md` become
+native packs. The flex-auth pack's live part uses the informed-decision pin and the
+four negative tests as parameterized steps. Keep the markdown until the packs are
+exercised.
+
+## Validate packs in this repository
+
+```task
+id: NK-WP-0044-T04
+status: done
+priority: medium
+```
+
+`make runbooks-validate` runs the `rtut` validator from the runbook-tutorials
+checkout (`RTUT_HOME`, default `~/runbook-tutorials`).
+
+## Exercise the packs through the UI
+
+```task
+id: NK-WP-0044-T05
+status: wait
+priority: high
+```
+
+Blocked on `RBT-WP-0004` (UI). Bernd runs the SSH, OpenBao and flex-auth packs in the
+UI; the engine records outcomes, and NK-WP-0009 T03-T05 close on those receipts.
+
+## Retire the markdown verifier
+
+```task
+id: NK-WP-0044-T06
+status: wait
+priority: low
+```
+
+Once the tutorials are packs, `tools/tutorial-verify` and `make tutorials-verify` are
+replaced by `runbooks-validate`, and `docs/tutorials/` becomes a pointer.
+
+## Acceptance Criteria
+
+- The console still works and is launched by the engine without changes to it.
+- Every NetKingdom pack validates; each is honestly labelled exercised or unexercised.