[SIMPL-30451] Verify the Kubernetes pipes transport on the sandbox

Run cff9b348-bfc3-4ac1-ab51-a94892b8e3a0 of loosely_coupled_k8s_job reached RUN_SUCCESS in dataprovider01 on sandbox-cat-dat: four payload Jobs, four distinct payload pod hostnames in contributing_hosts, and the payload log lines in the run log. Checks L4-L10 are now observed rather than derived. Torn down afterwards; the namespace was left as it was found.

Corrects two claims that were wrong. The registry does NOT require a pull secret - a bare GET returns 401, but that is the opening move of the Docker token handshake, and completing it anonymously returns the manifest for both images. And PIPES_PAYLOAD_NAMESPACE was set to a namespace named dagster, which does not exist on that cluster; the release is called dagster but runs in dataprovider01.

Adds the sandbox probe variant. The generic probe cannot run there: sandbox access is Rancher project-scoped, so a new namespace grants its creator nothing and Role creation is denied everywhere. It is not needed either, since dagster-role already carries the exact pipes permissions.

Changelog: added

documents/user-guide/distributed-execution-guide.md

@@ -8,8 +8,10 @@ integration pattern for a Dagster workflow on the Simpl orchestration platform.
 > implementations in this repository. The tightly coupled setup and the loosely
 > coupled **subprocess** transport are verified end to end, including runs
 > launched from the Dagster UI — see [section 5.6](#56-what-a-verified-run-actually-produced).
-> The loosely coupled **Kubernetes** transport is implemented and reviewed but
-> has not yet been run against a cluster; statements specific to it are marked
+> The loosely coupled **Kubernetes** transport was run on sandbox-cat-dat on
+> 2026-08-31 and reached `RUN_SUCCESS`; see the readiness checklist for the
+> evidence. What remains unproven on a cluster is the *tightly* coupled
+> Kubernetes path — `k8s_job_executor` — whose rows stay marked
 > **NOT CLUSTER-VERIFIED**. See [Outstanding work](#8-outstanding-work).
 
 ---
@@ -378,10 +380,12 @@ empty result. If your cluster's logging setup makes that transport unreliable,
 switch to an object-storage message reader, which needs a bucket plus
 credentials on both sides.
 
-> **NOT CLUSTER-VERIFIED.** The Kubernetes transport above is implemented and
-> its RBAC and configuration are recorded, but it has not yet been run against a
-> Simpl cluster. The subprocess transport, which exercises the identical payload
-> and the identical message-parsing path, is verified by the test suite.
+> **CLUSTER-VERIFIED 2026-08-31.** Run `cff9b348…` of `loosely_coupled_k8s_job`
+> reached `RUN_SUCCESS` on sandbox-cat-dat. Four payload Jobs were created, one
+> per work unit, and `contributing_hosts` held four distinct payload pod names —
+> so the work demonstrably ran off the orchestrator. The payload's log lines
+> reached the run log, which is the pod log stream serving as the message
+> channel exactly as described above.
 
 ### 5.4 Where setup selection is persisted
 
@@ -398,6 +402,7 @@ setting. There is no UI control that switches a workflow between the two pattern
 | `yaml/sandbox/values-sandbox-gitea.yaml` | Sandbox registry coordinates, pull secret, and the SHA both images share |
 | `yaml/loosely-coupled/rbac-pipes-dispatch.yaml` | Permissions required by the dispatching pod |
 | `yaml/loosely-coupled/probe-pipes-k8s.yaml` | Standalone cluster probe for the pipes transport (checklist L4–L9) |
+| `yaml/sandbox/probe-pipes-k8s-sandbox.yaml` | The same probe for sandbox-cat-dat, where project-scoped access forbids creating namespaces and RBAC |
 | `yaml/values-dagster-distributed-execution.yaml` | Code location image and entry point |
 
 The Launchpad can override *run configuration* — op config, resource config, tags
@@ -507,17 +512,18 @@ Tracked under SIMPL-30451.
 |---|---|---|
 | Execution-target choices, prerequisites, workflow-level documentation | AC1 | Complete |
 | Comparison, environment-fit indicators, trade-offs | AC2 | Complete |
-| Readiness checklist and evidence mapping | AC3 | Complete; K8s pipes checks not cluster-verified |
-| Misconfiguration symptoms and corrections | AC3 | Complete; K8s pipes symptoms not cluster-verified |
+| Readiness checklist and evidence mapping | AC3 | Complete; tightly coupled K8s executor rows not cluster-verified |
+| Misconfiguration symptoms and corrections | AC3 | Complete; tightly coupled K8s symptoms not cluster-verified |
 | Configuration constructs and persistence | AC4 | Complete |
 | Before-and-after example, tightly coupled | AC4 | Complete |
 | Before-and-after example, switching to loosely coupled | AC4 | Complete |
 | Runnable tightly coupled reference implementations | AC4 | Complete |
-| Runnable loosely coupled reference implementation | AC4 | Complete (subprocess verified, K8s not cluster-run) |
+| Runnable loosely coupled reference implementation | AC4 | Complete (subprocess and Kubernetes transports both verified) |
 | Both images build; payload image passes the isolation check (L11) | Tech details | Complete |
 | Locally runnable jobs launched from the Dagster UI, evidence recorded in section 5.6 | Tech details | Complete |
 | Payload image published to a container registry | Tech details | Complete on the sandbox Gitea registry; the GitLab registry still pending |
 | GitLab pipeline builds both images | Tech details | **Pending** — the shared `ds.gitlab-ci.yml` template builds one image from the root Dockerfile |
-| End-to-end run of `loosely_coupled_k8s_job` on a cluster | Tech details | **Pending** |
+| End-to-end run of `loosely_coupled_k8s_job` on a cluster | Tech details | Complete — sandbox-cat-dat, 2026-08-31, run `cff9b348…`; see the readiness checklist |
+| `distributed-execution` registered as a code location on a platform Dagster | Tech details | **Pending** — blocked on the 1.13.19 vs 1.12.8 control plane skew |
 | Screenshots of UI surfaces | Tech details | **Pending** — needs a deployed platform instance, not a local dev server |
 | Platform architecture document update | Tech details | **Pending** |