INFD-WP-0010-T02: release candidate for present_existing with compact-sitting v14

Candidate files: review policy pin v14 (sha256:8911458f...), the
nk-bind-executor present_existing registry row (daily limit 10), and an
8081 ingress peer for exactly sso + app.kubernetes.io/name=bounded-executor.
The state-hub row is unchanged and outcome_read stays off. The image pin
stays at the live f5588f49 because no owner-CI full-service image exists
yet; the founder runbook (deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md)
gates the release on it. Adds a side-effect-free present_existing probe
and release tests. Nothing applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

deploy/lifecycle/admission.candidate.json

@@ -3,8 +3,8 @@
   "policy": {
     "origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
     "package": "informed-decision.compact-sitting",
-    "version": "v13",
-    "package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873",
+    "version": "v14",
+    "package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde",
     "pod_name": "flex-auth-informed-decision-sitting"
   },
   "keycape_egress_ips": [
@@ -34,6 +34,10 @@
       {
         "namespace": "state-hub",
         "app": "state-hub"
+      },
+      {
+        "namespace": "sso",
+        "app": "bounded-executor"
       }
     ],
     "api_egress": [