feat(NET-WP-0018-T08): integrate validations into the UI state model

- Extended computed validation pattern into main gates:
  - Added keycape_openbao_client_deployed() (invokes verify-openbao-client.sh for live check).
  - Updated 'KeyCape OpenBao client deployed' gate in build_gates to 'done' if metadata or validator succeeds (T08: UI now proves via validation not just manual flag).
- Added validate-keycape-client subparser, dispatch (prints source+live status), and make target.
- Updated printed available actions list to include it.
- Updated T08 workplan section: status done + detailed 2026-06-03 implementation note (extended from 0019 note; covers one key target as example, pattern for others like LLDAP/privacyIDEA/Authelia using existing verify-*.sh).
- T07 tests + console-test cover; console status gates now reflect more validator output.
- Pragmatic: progress log with task_id, file notes, commit.
- Brief/fix next (expect 8/9 done).

This fulfills T08: more gates compute from validators (ok/fail) rather than manual only; live setup can satisfy checks via the integrated commands.

Makefile

@@ -180,6 +180,11 @@ security-bootstrap-scripts-syntax: ## Shell syntax check for bootstrap scripts
 	bash -n sso-mfa/k8s/lldap/break-glass.sh || true  # may have env assumptions
 	@echo "✔ bootstrap scripts syntax OK"
 
+security-bootstrap-validate-keycape-client: ## Validate KeyCape OpenBao client definition+deployment (T08)
+	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
+	  --metadata "$(SECURITY_BOOTSTRAP_METADATA)" \
+	  validate-keycape-client || true
+
 security-bootstrap-console: security-bootstrap-metadata-init ## Show guided security bootstrap status and safe actions
 	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
 	  --metadata "$(SECURITY_BOOTSTRAP_METADATA)" \
@@ -307,6 +312,7 @@ security-bootstrap-ui: security-bootstrap-metadata-init ## Serve local custody a
         security-bootstrap-validate-cleanup \
         security-bootstrap-validate-lifecycle-flow \
         security-bootstrap-validate-onboarding-dry-run \
+        security-bootstrap-validate-keycape-client \
         security-bootstrap-custody-roster-template \
         security-bootstrap-cleanup-evidence-template \
         security-bootstrap-lifecycle-flow-template \
@@ -319,4 +325,5 @@ security-bootstrap-ui: security-bootstrap-metadata-init ## Serve local custody a
         security-bootstrap-approve-custody \
         security-bootstrap-custody-packet security-bootstrap-openbao-preflight \
         security-bootstrap-metadata-init security-bootstrap-ui \
-        security-bootstrap-console-test security-bootstrap-scripts-syntax
+        security-bootstrap-console-test security-bootstrap-scripts-syntax \
+        security-bootstrap-validate-keycape-client