RPF-WP-0044-T06: founder cluster route and attended ESO adoption script

KUBECTL_ROUTE (agent default, founder-sudo = ssh railiance01 sudo -n) for the
bounded proof scripts; one attended script with go/no-go gates, typed ADOPT
confirmation, prune/force-off SSA sync and post-checks; evaluator and tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 527080@bnt-lap001
Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292

scripts/workload_adoption_proof.py

@@ -10,7 +10,7 @@ import re
 import subprocess
 from urllib.request import urlopen
 
-from argocd_adoption_proof import checked_run, identity, timestamp, tracking_settings
+from argocd_adoption_proof import _kube_route, checked_run, identity, timestamp, tracking_settings
 
 PIN = 'a3a8a27a8cda32ae3c7b55353ee16a131c50a0a0'
 CONTRACT = {
@@ -224,7 +224,7 @@ def main():
                 checked_run(['tar', '-x', '-C', temp], input=archive)
                 rendered = checked_run(['kubectl', 'kustomize', str(Path(temp) / CONTRACT['source_path'])])
             common = Path(__file__).with_name('argocd_adoption_proof.py').read_bytes()
-            observation = json.loads(checked_run(['ssh', 'railiance01', 'python3', '-'], input=remote_program(common, rendered), timeout=180))
+            observation = json.loads(checked_run(_kube_route().ssh_argv(['python3', '-']), input=remote_program(common, rendered), timeout=180))
             with urlopen(CONTRACT['health_url'], timeout=30) as response:
                 observation['public_health'] = {'url': response.geturl(), 'status': response.status}
             observation['metadata_captured_at'] = observation['captured_at']