Throwaway namespace, namespaced staging Issuer and a Certificate with a
distinct target name (cannot touch the live kc-tls object), operator runbook
with verify/cleanup/abort, and static guard tests. Source only; for
NK-WP-0049-T33 (decision 9f9d0d88 = A).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
a7c0e5b666