RPF-WP-0044-T06: founder cluster route and attended ESO adoption script

KUBECTL_ROUTE (agent default, founder-sudo = ssh railiance01 sudo -n) for the
bounded proof scripts; one attended script with go/no-go gates, typed ADOPT
confirmation, prune/force-off SSA sync and post-checks; evaluator and tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 527080@bnt-lap001
Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292

docs/runbooks/rpf-wp-0044-t04-attended.md

@@ -56,6 +56,16 @@ python3 -c "import json;d=json.load(open('docs/evidence/2026-10-11-issue-core-cr
 
    The journal contains only IDs, hashes and stage names, never key material.
 
+## Cluster route (since 2026-10-21)
+
+After the CUST-WP-0073 cutover the agent SSH login has no kubeconfig. Run the commands below through
+the founder admin path: prefix each remote `kubectl` with `sudo -n`, for example
+`ssh railiance01 "sudo -n kubectl …"`, and export `KUBECTL_ROUTE=founder-sudo` for the bounded
+scripts (`argocd_public_transport.py`, rapp-issue-core `make verify-live`, `make argocd-pin-drift`).
+The JSON in a `-p` patch must be escaped as `\"` inside the single quotes when the whole remote
+command is in double quotes (see the T06 runbook for the verified form). T04 is done (acd1ade); this
+section is kept for replays and rollback.
+
 ## Agent steps after `delivered_not_adopted`
 
 1. Commit the journal. Pin the Application: move `argocd/railiance01/drafts/issue-core.application.yaml`

docs/runbooks/rpf-wp-0044-t06-eso-adoption.md

@@ -21,6 +21,31 @@ Highest-risk adoption: ESO serves every ExternalSecret on railiance01. Prep rece
   read the k3s kubeconfig, and the custodian-agent observer role has no CRD, RBAC, webhook or ESO read.
   Run every `ssh railiance01 "kubectl …"` below through a login that still has cluster-admin read.
 
+## Attended script (preferred, 2026-10-21)
+
+The founder runs one script in their own terminal. It covers sections 1–4 below, with go/no-go gates
+and receipts under `docs/evidence/2026-10-21-eso-adoption-prep/attended-<UTC stamp>/`:
+
+```bash
+cd ~/railiance-platform && git pull --ff-only && (cd ~/rapp-issue-core && git pull --ff-only)
+scripts/rpf_wp_0044_t06_attended.sh --precheck-only   # optional: pre-checks only, changes nothing
+scripts/rpf_wp_0044_t06_attended.sh                    # pre-checks, create Application, type ADOPT, sync, post-checks
+```
+
+- **Route.** `KUBECTL_ROUTE=founder-sudo` is the script's default and runs `ssh railiance01 sudo -n kubectl …`.
+  `sudo -n` never prompts, so no `ssh -t` is needed and the pipes stay clean. The same variable selects
+  the route in `workload_adoption_proof.py`, `argocd_adoption_proof.py`, `argocd_public_transport.py`,
+  `activity_promotion_readiness.py`, `argocd_child_pin_drift.py`, `capture_service_observation.py` and
+  rapp-issue-core `tools/verify_live.py`. Their default stays `agent`, so an agent run never escalates.
+- **Smoke write.** The pre-check runs issue-core `verify-live --smoke`, which creates and closes one
+  Forgejo issue. The founder allowed this on 2026-10-21.
+- **Exit codes.** `2` = no-go before any change, `4` = post-check failed (rollback steps are printed,
+  nothing is pruned), `0` = adopted. `--dry-run` prints every command without running it.
+- **Credential-kind objects.** They are split out of the render before any live read, and the
+  evaluator (`scripts/eso_attended_checks.py`) refuses live input that contains one.
+
+The manual sections below remain the reference for what the script does.
+
 ## 1. Pre-check (founder, or agent once read access exists)
 
 ```bash
@@ -58,7 +83,7 @@ The root also carries other OutOfSync children. Creating the Application syncs n
 ## 3. The founder's sync command (one command)
 
 ```bash
-ssh railiance01 "kubectl -n argocd patch application external-secrets --type merge -p '{\"operation\":{\"initiatedBy\":{\"username\":\"rpf-wp-0044-t06\"},\"sync\":{\"revision\":\"0.16.1\",\"prune\":false,\"syncOptions\":[\"ServerSideApply=true\"],\"syncStrategy\":{\"apply\":{\"force\":false}}}}}'"
+ssh railiance01 "sudo -n kubectl -n argocd patch application external-secrets --type merge -p '{\"operation\":{\"initiatedBy\":{\"username\":\"rpf-wp-0044-t06\"},\"sync\":{\"revision\":\"0.16.1\",\"prune\":false,\"syncOptions\":[\"ServerSideApply=true\"],\"syncStrategy\":{\"apply\":{\"force\":false}}}}}'"
 ```
 
 (Local double quotes; the remote shell receives the JSON inside single quotes. Prune off, force off, SSA.)