docs: replace prose placeholders in reproduction steps with executable commands

The audit found ~80 placeholders, and the damaging ones were where the
measuring apparatus itself was prose rather than a command:

  a6  "( curl ... ) & 를 20개 띄우고 wait"  — the 22.2s headline came from this
  a3  "<로그인 반복, sid 를 /tmp/sids 에>"  — the whole RPO measurement
  a3  "<sid 목록>"                          — the control it is compared against
  a5  "<수신 파드IP>"                       — the injection
  a8  writes /tmp/tok, reads /tmp/rt        — self-inconsistent, sent an empty token
  b3  $KC / $RT / $NEW never assigned
  c2  bare kcadm.sh with no kubectl exec
  a1  conntrack tuples written by hand, though the direction flips per restart

Each is now a shell-expandable form: pod IPs from jsonpath, the admin password
from the secret, ids from kcadm --format csv, conntrack tuples derived from
"conntrack -L" with awk rather than transcribed.

Then the rewritten commands were executed against the live cluster, and one
of them failed — the 20-way load generator, written as "kubectl run --rm -i",
lost its output stream twice in a row. That is a trap this series already hit
once, and the rewrite reintroduced it. A-6 now uses a resident probe pod that
collects into a file and is cat-ed once; verified 20/20 lines.

Evidence: docs/evidence/followup/05-command-reproducibility.txt

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/experiment-a3-database-crash.md

@@ -330,8 +330,21 @@ kubectl -n keycloak-lab exec deploy/postgres -- psql -U keycloak -d keycloak \
 kubectl -n keycloak-lab exec deploy/postgres -- psql -U keycloak -d keycloak \
   -c "delete from offline_user_session"
 
-# 2. 로그인 루프 (호스트에서 백그라운드 exec — 파드 안 & 는 exec 종료와 함께 죽는다)
-kubectl -n keycloak-lab exec a2-probe -- sh -c '<로그인 반복, sid 를 /tmp/sids 에>' &
+# 2. 로그인 루프 — 호스트에서 백그라운드로 exec 한다.
+#    파드 안에서 ( ... ) & 로 띄우면 exec 세션이 끝날 때 같이 죽는다(실측).
+K0=$(kubectl -n keycloak-lab get pod keycloak-0 -o jsonpath='{.status.podIP}')
+kubectl -n keycloak-lab exec a2-probe -- sh -c "
+  i=0
+  while [ \$i -lt 200 ]; do
+    R=\$(curl -s --max-time 5 -X POST http://$K0:8080/realms/master/protocol/openid-connect/token \
+         -d grant_type=password -d client_id=admin-cli -d username=admin -d password=lab-admin-change-me)
+    S=\$(echo \"\$R\" | sed -n 's/.*\"access_token\":\"\\([^\"]*\\)\".*/\\1/p' \
+         | cut -d. -f2 | sed 's/\$/==/' | base64 -d 2>/dev/null \
+         | sed -n 's/.*\"sid\":\"\\([^\"]*\\)\".*/\\1/p')
+    [ -n \"\$S\" ] && echo \"\$S\" >> /tmp/sids
+    i=\$((i+1))
+  done" >/dev/null 2>&1 &
+LOOP=$!
 
 # 3. 진짜 크래시 — 백엔드 프로세스에 SIGKILL
 kubectl -n keycloak-lab exec deploy/postgres -- \
@@ -340,9 +353,14 @@ kubectl -n keycloak-lab exec deploy/postgres -- \
 # 4. 주입이 걸렸는지 확인 — 이게 없으면 결과를 해석하지 않는다
 kubectl -n keycloak-lab logs deploy/postgres | grep -E "not properly shut down|redo"
 
-# 5. 대조
-kubectl -n keycloak-lab exec deploy/postgres -- psql -U keycloak -d keycloak -tAc \
-  "select count(*) from offline_user_session where user_session_id in (<sid 목록>)"
+# 5. 대조 — 클라이언트가 200 을 받은 sid 를 그대로 IN 절로 만든다
+kill $LOOP 2>/dev/null
+kubectl -n keycloak-lab exec a2-probe -- cat /tmp/sids > /tmp/sids.txt
+TOTAL=$(wc -l < /tmp/sids.txt)
+IN=$(sed "s/^/'/; s/$/'/" /tmp/sids.txt | paste -sd,)
+FOUND=$(kubectl -n keycloak-lab exec deploy/postgres -- psql -U keycloak -d keycloak -tAc \
+  "select count(*) from offline_user_session where offline_flag='0' and user_session_id in ($IN)")
+echo "클라이언트 성공 $TOTAL / DB 존재 $FOUND / 유실 $((TOTAL-FOUND))"
 ```
 
 ---