Prune retired bao.coulomb.social callbacks from platform-admin; declare OIDC mount config

Attended run 2026-09-23T23:11Z: status pruned, tunnel callback kept, all
other role settings preserved and verified on readback. Declarations now
match live; railiance-platform owns the mount config.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

docs/openbao.md

@@ -400,8 +400,13 @@ Declared state of the administrator login (verified live 2026-09-23,
 
 - role `auth/netkingdom/role/platform-admin`:
   `openbao/auth/netkingdom-platform-admin-role.json`. It is written by
-  net-kingdom `sso-mfa/k8s/keycape/configure-openbao-oidc.sh`, which lacks
-  `operator-custody` and still lists retired `bao.coulomb.social` callbacks.
+  railiance-platform only. Since net-kingdom `a356f64`, its
+  `configure-openbao-oidc.sh` no longer writes the role. The retired
+  `bao.coulomb.social` callbacks were pruned on 2026-09-23
+  (`docs/evidence/2026-09-24-platform-admin-callback-prune.json`).
+- OIDC mount config: `openbao/auth/netkingdom-oidc-config.json` and
+  `openbao/auth/keycape-oidc-config.json`, owned by railiance-platform. The
+  compatibility `oidc_client_secret` is not declared.
 - policies `openbao/policies/platform-admin.hcl` and
   `openbao/policies/operator-custody.hcl`, plus the built-in `default`
   (`token_no_default_policy: false`). `default` grants `auth/token/revoke-self`