install.sh, update.sh and test.sh get one slide each, with the real content of
each — including why a 401 from Cockpit is a passing test and why test.sh uses
curl -s rather than --fail.
Corrects the identity story: Cockpit is not an OIDC client and cannot be
configured into one, so the contract shows identity:accessControl and the demo
slide is honest that Authentik gates the URL while Cockpit still asks for a
local account. Full analysis in the module's DESIGN.md.
33e783efb5