INFD-WP-0010-T02: release candidate for present_existing with compact-sitting v14

Candidate files: review policy pin v14 (sha256:8911458f...), the
nk-bind-executor present_existing registry row (daily limit 10), and an
8081 ingress peer for exactly sso + app.kubernetes.io/name=bounded-executor.
The state-hub row is unchanged and outcome_read stays off. The image pin
stays at the live f5588f49 because no owner-CI full-service image exists
yet; the founder runbook (deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md)
gates the release on it. Adds a side-effect-free present_existing probe
and release tests. Nothing applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

deploy/lifecycle/intake-submitters.json

@@ -8,5 +8,21 @@
       "net-kingdom-admins"
     ],
     "daily_limit": 50
+  },
+  "system:serviceaccount:sso:nk-bind-executor": {
+    "submitter_id": "nk-bind-executor",
+    "memo_classes": [
+      "bounded-execution"
+    ],
+    "review_groups": [
+      "net-kingdom-admins"
+    ],
+    "daily_limit": 10,
+    "present_existing": {
+      "approval_actor": "service:nk-bind-executor",
+      "actions": [
+        "bounded-execution"
+      ]
+    }
   }
 }