RPF-WP-0044-T06: founder cluster route and attended ESO adoption script

KUBECTL_ROUTE (agent default, founder-sudo = ssh railiance01 sudo -n) for the
bounded proof scripts; one attended script with go/no-go gates, typed ADOPT
confirmation, prune/force-off SSA sync and post-checks; evaluator and tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 527080@bnt-lap001
Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292

scripts/argocd_adoption_proof.py

@@ -34,6 +34,16 @@ CONTRACT = {
 }
 
 
+def _kube_route():
+    """Local-only import; this module's source may also run remotely without it."""
+    import sys
+    here = str(Path(__file__).resolve().parent)
+    if here not in sys.path:
+        sys.path.insert(0, here)
+    import kube_route
+    return kube_route
+
+
 def checked_run(command, *, input=None, timeout=30):
     try:
         result = subprocess.run(command, input=input, capture_output=True, timeout=timeout)
@@ -306,7 +316,7 @@ def render_diff(source_root, contract):
         if re.findall(rb'^kind: (.+)$', rendered, re.M) != [b'ClusterSecretStore']:
             raise ValueError('pinned render resource kind unverified')
         encoded = base64.b64encode(rendered).decode()
-        return json.loads(checked_run(['ssh', 'railiance01', 'python3', '-', '--remote-diff', '--render-base64', encoded],
+        return json.loads(checked_run(_kube_route().ssh_argv(['python3', '-', '--remote-diff', '--render-base64', encoded]),
                                      input=Path(__file__).read_bytes(), timeout=150))
 
 
@@ -331,7 +341,7 @@ def main():
         if args.live:
             if not args.source_root:
                 raise ValueError('source root required for pinned rendering')
-            raw = checked_run(['ssh', 'railiance01', 'python3', '-', '--remote-collect'],
+            raw = checked_run(_kube_route().ssh_argv(['python3', '-', '--remote-collect']),
                               input=Path(__file__).read_bytes(), timeout=120)
             observation = json.loads(raw)
             observation['pinned_render_diff'] = render_diff(args.source_root, CONTRACT)