docs: replace prose placeholders in reproduction steps with executable commands

The audit found ~80 placeholders, and the damaging ones were where the
measuring apparatus itself was prose rather than a command:

  a6  "( curl ... ) & 를 20개 띄우고 wait"  — the 22.2s headline came from this
  a3  "<로그인 반복, sid 를 /tmp/sids 에>"  — the whole RPO measurement
  a3  "<sid 목록>"                          — the control it is compared against
  a5  "<수신 파드IP>"                       — the injection
  a8  writes /tmp/tok, reads /tmp/rt        — self-inconsistent, sent an empty token
  b3  $KC / $RT / $NEW never assigned
  c2  bare kcadm.sh with no kubectl exec
  a1  conntrack tuples written by hand, though the direction flips per restart

Each is now a shell-expandable form: pod IPs from jsonpath, the admin password
from the secret, ids from kcadm --format csv, conntrack tuples derived from
"conntrack -L" with awk rather than transcribed.

Then the rewritten commands were executed against the live cluster, and one
of them failed — the 20-way load generator, written as "kubectl run --rm -i",
lost its output stream twice in a row. That is a trap this series already hit
once, and the rewrite reintroduced it. A-6 now uses a resident probe pod that
collects into a file and is cat-ed once; verified 20/20 lines.

Evidence: docs/evidence/followup/05-command-reproducibility.txt

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/experiment-c2-backchannel-logout.md

@@ -27,7 +27,7 @@
 ### IdP 쪽
 
 ```bash
-kcadm.sh get clients -r keycloak-patterns -q clientId=bff-confidential --fields attributes
+kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh get clients -r keycloak-patterns -q clientId=bff-confidential --fields attributes
 ```
 
 ```
@@ -68,7 +68,7 @@ Spring Security 6.2+ 는 백채널 로그아웃을 지원하지만 **명시적
 ## 2. IdP 쪽만 설정하고 시험했다
 
 ```bash
-kcadm.sh update clients/<id> -r keycloak-patterns \
+kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh update clients/$(kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh get clients -r keycloak-patterns -q clientId=bff --fields id --format csv --noquotes | tail -1) -r keycloak-patterns \
   -s 'attributes={"backchannel.logout.url":"https://app1.hyeonworks.com/logout/connect/back-channel/keycloak",
                   "backchannel.logout.session.required":"true"}'
 ```
@@ -94,7 +94,7 @@ kcadm.sh update clients/<id> -r keycloak-patterns \
   Redis: 1 키
 
 === IdP 로그아웃 ===
-  kcadm.sh create users/<id>/logout -r keycloak-patterns
+  kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh create users/$(kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh get users -r keycloak-patterns -q username=labuser --fields id --format csv --noquotes | tail -1)/logout -r keycloak-patterns
 
 === 결과 ===
   keycloak-patterns 세션: 0        ← IdP 쪽은 끊겼다
@@ -227,12 +227,12 @@ app2(oauth2-proxy)는 못 한다. **한 SSO 안에서 로그아웃 전파가 앱
 
 ```bash
 # 1. 현재 설정 확인 — 어느 쪽에도 없다
-kcadm.sh get clients -r keycloak-patterns -q clientId=bff-confidential --fields attributes
+kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh get clients -r keycloak-patterns -q clientId=bff-confidential --fields attributes
 grep -rn "oidcLogout\|backchannel" bff/src/main/java/
 curl -s -o /dev/null -w '%{http_code}\n' -X POST https://app1.hyeonworks.com/logout/connect/back-channel/keycloak
 
 # 2. IdP 쪽 설정 — 점 표기는 안 먹는다. JSON 으로
-kcadm.sh update clients/<id> -r keycloak-patterns \
+kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh update clients/$(kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh get clients -r keycloak-patterns -q clientId=bff --fields id --format csv --noquotes | tail -1) -r keycloak-patterns \
   -s 'attributes={"backchannel.logout.url":"...","backchannel.logout.session.required":"true"}'
 
 # 3. ★ 살아 있는 세션이 있는지 먼저 확인한다 (realm 을 join 해서)
@@ -241,7 +241,7 @@ kubectl -n keycloak-lab exec deploy/postgres -- psql -U keycloak -d keycloak -tA
     where r.name='keycloak-patterns' and us.offline_flag='0'"
 
 # 4. 로그아웃하고 앱 세션을 본다
-kcadm.sh create users/<user-id>/logout -r keycloak-patterns
+kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh create users/$(kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh get users -r keycloak-patterns -q username=labuser --fields id --format csv --noquotes | tail -1)/logout -r keycloak-patterns
 kubectl -n keycloak-lab exec deploy/redis -- redis-cli dbsize
 
 # 5. 도달성 확인 — 클러스터 안에서 앱 공개 URL 로