Reconcile packaging, bootstrap and migration credential handling

Closes gap G09: five loosely related defects.

lldap-export took the service account password on argv, where ps exposes it to
any local user and shell history and process accounting capture it. It now
prefers KEYCAPE_LLDAP_BIND_PW or --bind-pw-file; --bind-pw still works but warns,
deprecated rather than removed because existing runbooks use it and breaking them
silently would be worse than one more cycle of exposure. Conflicting sources are
rejected instead of silently ranked, since an operator otherwise cannot tell
which bind was attempted. Both migration scripts pass the password by
environment now.

The canonical export, generated LDIF and Keycloak realm were written 0644. None
carries credential material, but the snapshot is every username, display name,
email and group membership in the estate, and it tends to land in /tmp. All three
are 0600.

The image packaged keycape alone, so the validator and migration binaries needed
a Go toolchain on the host -- which defeats shipping an image for the cutover
work they exist to support. All five ship; the issuer stays the entrypoint.
Verified by building the image and running each binary inside it.

The publish workflow named 92.205.130.254:32166 while the cluster runs
forgejo.coulomb.social/coulomb/key-cape. It now defaults to the recorded name and
stays overridable by a repository variable. This repository cannot verify that
the runner resolves that hostname or that the registry credentials are valid for
it; if the next publish fails, set the REGISTRY variable back to the address.

docker-compose.dev.yml mounts a private key and Authelia material that are
correctly absent from the checkout. scripts/bootstrap-dev.sh generates them
locally under a restrictive umask rather than chmodding afterwards, so the key is
never briefly world-readable. Everything it writes is git-ignored.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6

history/2026-09-05-011726-scope-intent-assessment.md

@@ -427,6 +427,21 @@ artifact locations and release references, and adopt safe credential input and
 appropriate export permissions. A documented external bootstrap may satisfy
 scope without storing secrets in this repository.
 
+**Status 2026-09-08 (KEY-WP-0026): closed, with one item an operator must
+confirm.** `scripts/bootstrap-dev.sh` generates the key and Authelia material the
+dev stack mounts, all git-ignored and created under a restrictive umask rather
+than chmodded after. The image now ships all five binaries, verified by running
+each inside a built image. `lldap-export` prefers `KEYCAPE_LLDAP_BIND_PW` or
+`--bind-pw-file` and warns on the deprecated `--bind-pw`, which stays working for
+existing runbooks; both migration scripts pass the password by environment. The
+export, LDIF and realm artifacts are written `0600`.
+
+The publish workflow now defaults to `forgejo.coulomb.social` rather than
+`92.205.130.254:32166`, overridable by a repository variable. **This is the one
+part not verifiable from here:** whether the runner resolves that name and
+whether the registry credentials are valid for it can only be established by a
+publish. If it fails, set the `REGISTRY` variable back to the address.
+
 ### G10 — Source capability is ahead of live custody and consumer adoption
 
 **Priority: high for rollout; medium for handoff hygiene. Kind: external dependency/proof gap.**