NK-WP-0058-T07: conventions lint, server-side applies, one cluster route

tools/conventions/lint.py (make conventions-lint, contract suite): server-side-apply, one-wait-condition,
one-cluster-route, tool-numbered-receipts, managing-controller (Argo-owned paths from railiance-platform),
with reasoned exceptions. 21 runbook applies made server-side. portal-client-rollout.py (and so
keycape-client.py and the rollout tools) and identity-provisioner-reconcile.py use NK_KUBECONFIG,
default ~/.kube/config-railiance01, without a second kubeconfig or --server override.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

docs/keycape-approval-clients-rollout.md

@@ -22,7 +22,7 @@ native scope/auth/namespace denials and reader revocation. It invokes this
 repository's `sso-mfa/k8s/keycape/approval-clients-rollout.py` for image/config
 replacement and service acceptance. Do not run the platform child directly.
 On this workstation the verified Railiance kubeconfig is
-`/home/worsch/.kube/config-railiance01`; the default config targets another endpoint.
+`~/.kube/config-railiance01` (`NK_KUBECONFIG` overrides it); the default config targets another endpoint.
 
 Use `activate` only for a first provision with absent custody and delivery.
 `resume-activate --prior-receipt <metadata receipt>` requires a completed compatible