Add KeyCape exposure approval template

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093

docs/keycape-exposure-rotation-approval.example.json

@@ -0,0 +1,50 @@
+{
+  "incident_id": "KEYCAPE-EXPOSURE-20260823-01",
+  "status": "pending",
+  "secret_ref": {
+    "namespace": "sso",
+    "name": "keycape-config",
+    "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3",
+    "resource_version": "51326531"
+  },
+  "runtime_anchor": {
+    "deployment": "keycape",
+    "generation": 25,
+    "observed_generation": 25,
+    "ready": 1,
+    "available": 1,
+    "image": "key-cape:mfa-client-20260809",
+    "issuer": "https://kc.coulomb.social",
+    "jwks_kid": "key-1",
+    "jwks_sha256": "8e3237da6030c6af91c5005d0112a149204bc549f67d2234939c5581fdb95a32"
+  },
+  "strategy": {
+    "signing": "pending-keycape-ack",
+    "predecessor_jwt": "reject-after-cutover",
+    "forward_only": true
+  },
+  "revisions": {
+    "key_cape": "REQUIRED",
+    "net_kingdom": "REQUIRED",
+    "railiance_platform": "453fed3"
+  },
+  "window": {
+    "starts_at": "REQUIRED",
+    "ends_at": "REQUIRED",
+    "max_minutes": 30
+  },
+  "operators": {
+    "driver": "REQUIRED",
+    "abort": "REQUIRED"
+  },
+  "acknowledgements": {
+    "key_cape_message_id": null,
+    "net_kingdom_message_id": null
+  },
+  "authorization": {
+    "human_go": false,
+    "provider_writes": false,
+    "secret_apply": false,
+    "predecessor_revocation": false
+  }
+}