docs: replace prose placeholders in reproduction steps with executable commands

The audit found ~80 placeholders, and the damaging ones were where the
measuring apparatus itself was prose rather than a command:

  a6  "( curl ... ) & 를 20개 띄우고 wait"  — the 22.2s headline came from this
  a3  "<로그인 반복, sid 를 /tmp/sids 에>"  — the whole RPO measurement
  a3  "<sid 목록>"                          — the control it is compared against
  a5  "<수신 파드IP>"                       — the injection
  a8  writes /tmp/tok, reads /tmp/rt        — self-inconsistent, sent an empty token
  b3  $KC / $RT / $NEW never assigned
  c2  bare kcadm.sh with no kubectl exec
  a1  conntrack tuples written by hand, though the direction flips per restart

Each is now a shell-expandable form: pod IPs from jsonpath, the admin password
from the secret, ids from kcadm --format csv, conntrack tuples derived from
"conntrack -L" with awk rather than transcribed.

Then the rewritten commands were executed against the live cluster, and one
of them failed — the 20-way load generator, written as "kubectl run --rm -i",
lost its output stream twice in a row. That is a trap this series already hit
once, and the rewrite reintroduced it. A-6 now uses a resident probe pod that
collects into a file and is cat-ed once; verified 20/20 lines.

Evidence: docs/evidence/followup/05-command-reproducibility.txt

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/experiment-a8-rolling-restart.md

@@ -192,10 +192,23 @@ kubectl -n keycloak-lab run a8-probe --image=curlimages/curl:8.11.1 \
   --restart=Never --command -- sleep 3600
 kubectl -n keycloak-lab wait --for=condition=Ready pod/a8-probe --timeout=120s
 
-# 로그인하고 토큰 보관
+# 변수 준비
+K0=$(kubectl -n keycloak-lab get pod keycloak-0 -o jsonpath='{.status.podIP}')
+PW=$(kubectl -n keycloak-lab get secret keycloak-lab-secrets \
+       -o jsonpath='{.data.KC_BOOTSTRAP_ADMIN_PASSWORD}' | base64 -d)
+
+# 로그인하고 refresh token 을 /tmp/rt 에, sid 를 /tmp/sid 에 보관.
+# ★ 아래 5번이 읽는 파일과 같은 이름이어야 한다 — 처음 문서는 /tmp/tok 에 쓰고
+#   /tmp/rt 를 읽어서 빈 문자열을 보냈고, 그래도 400 이 아니라 통과한 것처럼 보였다.
 kubectl -n keycloak-lab exec a8-probe -- sh -c \
-  'curl -s -X POST http://<pod>:8080/realms/master/protocol/openid-connect/token \
-     -d grant_type=password -d client_id=admin-cli -d username=admin -d password=<pw> > /tmp/tok'
+  "curl -s -X POST http://$K0:8080/realms/master/protocol/openid-connect/token \
+     -d grant_type=password -d client_id=admin-cli -d username=admin -d password=$PW > /tmp/tok
+   sed -n 's/.*\"refresh_token\":\"\\([^\"]*\\)\".*/\\1/p' /tmp/tok > /tmp/rt
+   sed -n 's/.*\"access_token\":\"\\([^\"]*\\)\".*/\\1/p' /tmp/tok | cut -d. -f2 \
+     | sed 's/\$/==/' | base64 -d 2>/dev/null \
+     | sed -n 's/.*\"sid\":\"\\([^\"]*\\)\".*/\\1/p' > /tmp/sid
+   echo \"rt \$(wc -c < /tmp/rt) bytes / sid \$(cat /tmp/sid)\""
+
 
 # 재시작 + 가용성 감시
 kubectl -n keycloak-lab rollout restart statefulset/keycloak
@@ -203,12 +216,13 @@ kubectl -n keycloak-lab rollout status statefulset/keycloak --timeout=420s
 
 # 세션 생존 확인
 kubectl -n keycloak-lab exec a8-probe -- sh -c \
-  'curl -s -o /dev/null -w "%{http_code}\n" -X POST http://<pod>:8080/realms/master/protocol/openid-connect/token \
+  'curl -s -o /dev/null -w "%{http_code}\n" -X POST http://'$K0':8080/realms/master/protocol/openid-connect/token \
      -d grant_type=refresh_token -d client_id=admin-cli -d refresh_token=$(cat /tmp/rt)'
 
 # DB 대조
 kubectl -n keycloak-lab exec deploy/postgres -- psql -U keycloak -d keycloak \
-  -c "select user_session_id, created_on, last_session_refresh from offline_user_session where user_session_id='<sid>'"
+  -c "select user_session_id, created_on, last_session_refresh from offline_user_session
+       where offline_flag='0' and user_session_id='$(kubectl -n keycloak-lab exec a8-probe -- cat /tmp/sid)'"
 ```
 
 ---