NK-WP-0056-T04: svc-authelia bind lane (source only, CCR-2026-0053)

bind-lane.py gains per-lane Secret keys. Authelia keeps its bind user in
authelia-config, so setup refuses unless the live configuration binds
uid=svc-authelia, and only the ldap_password key is decoded. The ESO manifest
merges ldap_password alone into authelia-secrets. The tests are parametrized
per lane (12). tools/service-binds is now listed in security-tools.json, which
fixes the index test that failed after the pilot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2

tools/security-tools.json

@@ -23,6 +23,9 @@
     {"id": "rotation-lanes", "path": "tools/rotation-lanes", "answers": "Does every known credential have a rotation lane with blast radius, verification step and owner?",
      "run": "make rotation-lanes-check", "test": "make rotation-lanes-test", "agent_may_run": "yes",
      "standard": "canon/standards/credential-management_v0.2.md"},
+    {"id": "service-binds", "path": "tools/service-binds", "answers": "Is an LLDAP service bind held in OpenBao and delivered by ESO exactly as its approved CCR says, equal to the live Secret?",
+     "run": "python3 tools/service-binds/bind-lane.py setup|verify <lane> --ccr-sha256 <hash> --kubeconfig <path> --receipt <new.json>", "test": "python3 -m pytest tests/test_service_bind_lane.py", "agent_may_run": "no-attended",
+     "standard": "canon/standards/credential-management_v0.2.md"},
     {"id": "custody-record", "path": "tools/custody-record", "answers": "Is a platform-root custody record valid, and may a root grant be observed from it?",
      "run": "uv run tools/custody-record/validate.py <record.json>", "test": "make custody-record-test", "agent_may_run": "yes",
      "standard": "docs/adr/ADR-0017-root-grant-custody-and-account-authority.md"},