sso.py: list_realms, delete_keycloak_realm (idempotent, refuses master), realms_to_reap (pure, concurrency-safe predicate), reap_orphaned_realms. The per-run realm is the isolation unit on a shared live-warm keycloak; orphans (crashed runs) reaped by hex not mapping to a live app stack. +8 unit tests (tests/unit/test_warm_realm.py); 43 unit pass on cc-ci. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>