DISCTL-WP-0004: adopt the NetKingdom identity backup lane

Register backup-netkingdom-identity (LLDAP, privacyIDEA DB/token
material/audit, KeyCape client registry archive) as a T0 backup stream:
daily 03:45 UTC age-encrypted upload to one off-host provider (Storage
Share), hourly on-host health check with a 25h freshness bound, RPO 24h.
Activation evidence net-kingdom NK-WP-0049-T14 (2026-10-16).

Record accepted residual risks G1 (single off-host provider) and G2
(on-host-only freshness detection, watchdog owed by
RAPP-TELEMETRY-WP-0001-T04) until 2027-01-31, and the quarterly
isolated identity restore drill (net-kingdom NK-WP-0053, first due by
2027-01-31) in BackupPolicy, RTO-RPO matrix and TestEvidence cadence.

Requested by net-kingdom (hub message ef2bf2a9); founder decision
e4c288d9 resolved 2026-10-23.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6

TestEvidence/README.md

@@ -55,4 +55,9 @@ Next targets:
 2. **S2 k3s runtime** — decrypt `railiance-backup-s2` on railiance01
 3. **Dev workstation cold restore** — password-manager key only
 4. **Gitea dump** — before next migration wave
-5. **Secret vault cold decrypt** — SOPS/age recovery material (R5)
+5. **Secret vault cold decrypt** — SOPS/age recovery material (R5)
+6. **NetKingdom identity isolated restore** — quarterly, first due by
+   2027-01-31; run by `net-kingdom` NK-WP-0053 per
+   `net-kingdom/docs/identity-restore-drill.md`. Canonical evidence lives under
+   `net-kingdom/docs/evidence/<date>-identity-restore-drill/`; link it here as
+   `restore-drill-<date>-netkingdom-identity.md` (DISCTL-WP-0004-T03).