NK-WP-0054-T05: pin LLDAP to the running v0.6.2 digest

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56

sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md

@@ -32,7 +32,7 @@ mkdir -p -m 700 ~/nk54
 
 1. **Restore drill on the current backup** (NK-WP-0053-T02/T04) has passed. It proves today's backup
    before the change.
-2. **Pin LLDAP to what runs.** Read the running digest (no Secret is read):
+2. **Pin LLDAP to what runs.** Done 2026-10-29: the running digest is v0.6.2 and `deployment.yaml` is pinned. Read the running digest (no Secret is read):
    ```bash
    $K -n sso get pod -l app.kubernetes.io/name=lldap -o jsonpath='{.items[0].status.containerStatuses[0].imageID}'; echo
    ```

sso-mfa/k8s/lldap/deployment.yaml

@@ -43,9 +43,9 @@ spec:
 
       containers:
         - name: lldap
-          # Pin to the running digest before the bind split (NK-WP-0054-T05 runbook); the restore
-          # tools and the rehearsal use v0.6.2 (sha256:9e605a66...). Never pin to an older version.
-          image: lldap/lldap:stable
+          # v0.6.2, the running digest read 2026-10-29 and the version the restore tools and the
+          # NK-WP-0054-T05 rehearsals use. Never pin to an older version.
+          image: docker.io/lldap/lldap@sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d
           imagePullPolicy: IfNotPresent
 
           ports: