docs: replace prose placeholders in reproduction steps with executable commands

The audit found ~80 placeholders, and the damaging ones were where the
measuring apparatus itself was prose rather than a command:

  a6  "( curl ... ) & 를 20개 띄우고 wait"  — the 22.2s headline came from this
  a3  "<로그인 반복, sid 를 /tmp/sids 에>"  — the whole RPO measurement
  a3  "<sid 목록>"                          — the control it is compared against
  a5  "<수신 파드IP>"                       — the injection
  a8  writes /tmp/tok, reads /tmp/rt        — self-inconsistent, sent an empty token
  b3  $KC / $RT / $NEW never assigned
  c2  bare kcadm.sh with no kubectl exec
  a1  conntrack tuples written by hand, though the direction flips per restart

Each is now a shell-expandable form: pod IPs from jsonpath, the admin password
from the secret, ids from kcadm --format csv, conntrack tuples derived from
"conntrack -L" with awk rather than transcribed.

Then the rewritten commands were executed against the live cluster, and one
of them failed — the 20-way load generator, written as "kubectl run --rm -i",
lost its output stream twice in a row. That is a trap this series already hit
once, and the rewrite reintroduced it. A-6 now uses a resident probe pod that
collects into a file and is cat-ed once; verified 20/20 lines.

Evidence: docs/evidence/followup/05-command-reproducibility.txt

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/experiment-followup-untested-items.md

@@ -130,15 +130,37 @@ B-4 를 할 때 **oauth2-proxy 가 아직 배포되지 않아** "proxy session"
 role 을 헤더로 내보내려면 추가 설정이 필요한데, **"IdP 의 클레임 변경이
 언제 반영되는가" 라는 질문은 어느 클레임이든 같다.**
 
+1 · 3 단계는 **브라우저 콘솔**에서 실행한다. oauth2-proxy 쿠키가 HttpOnly 라
+curl 로는 로그인 상태를 재현할 수 없기 때문이다(그래서 셸이 아니라 JS 다).
+
+```js
+// 1. 기준선 — 로그인된 app2 탭의 콘솔에서
+for (let i = 0; i < 3; i++) {
+  const r = await (await fetch('/api/echo')).text();
+  console.log(new Date().toISOString(), r.match(/x-forwarded-email: (.*)/)[1]);
+}
+
+// 3. 반복 요청 — 0.5초 간격으로 12번
+for (let i = 0; i < 12; i++) {
+  const r = await (await fetch('/api/echo')).text();
+  console.log(new Date().toISOString(), r.match(/x-forwarded-email: (.*)/)[1]);
+  await new Promise(s => setTimeout(s, 500));
+}
+```
+
+2 단계는 셸에서:
+
 ```bash
-# 1. 기준선
-fetch('/api/echo') → x-forwarded-email = labuser@example.com
-
 # 2. IdP 에서 바꾼다
-kcadm.sh update users/<id> -r keycloak-patterns -s email=CHANGED-labuser@example.com
+UID=$(kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh \
+        get users -r keycloak-patterns -q username=labuser \
+        --fields id --format csv --noquotes | tail -1)
+kubectl -n keycloak-lab exec keycloak-0 -- /opt/keycloak/bin/kcadm.sh \
+  update users/$UID -r keycloak-patterns -s email=CHANGED-labuser@example.com
 
-# 3. 반복 요청
-for (i=1..12) fetch('/api/echo')   # 0.5초 간격
+# 4. Redis 세션을 지워 재인증을 강제한다 (반영 조건 확인)
+kubectl -n keycloak-lab exec deploy/redis -- redis-cli --scan --pattern 'oauth2-proxy*' \
+  | xargs -r kubectl -n keycloak-lab exec deploy/redis -- redis-cli del
 ```
 
 ### 결과 — 반영되지 않는다