NK-WP-0056-T05: synthetic MFA journey runner; split T05 into T05/T08/T09/T10

Stdlib runner that signs a synthetic user in through KeyCape (PKCE, aal2),
Authelia first factor and the privacyIDEA-backed OTP challenge, verifies the
ID token (RS256 via JWKS, assurance aal2/otp) and writes a value-free receipt
naming the first failed step and the bind on it. 26 tests with per-bind fakes
run in the identity-provider journey acceptance workflow.

Founder decision 2026-10-31: real pinned images for the synthetic stack (T08),
synthetic user and seed in OpenBao (T09), unattended live run (T10).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

.forgejo/workflows/identity-journeys.yaml

@@ -2,7 +2,7 @@ name: Identity provider journey acceptance
 on:
   push:
     branches: [main]
-    paths: ["identity-provisioner/**", ".forgejo/workflows/identity-journeys.yaml"]
+    paths: ["identity-provisioner/**", "sso-mfa/k8s/synthetic-journey/**", ".forgejo/workflows/identity-journeys.yaml"]
   workflow_dispatch:
 jobs:
   provider:
@@ -18,3 +18,8 @@ jobs:
           tar xzf identity-source.tar.gz -C identity-source --strip-components=1
           cd identity-source
           PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=identity-provisioner python3 -m unittest discover -s identity-provisioner/tests -v
+      - name: Run synthetic MFA journey runner tests (NK-WP-0056-T05)
+        run: |
+          set -eu
+          cd identity-source/sso-mfa/k8s/synthetic-journey
+          PYTHONDONTWRITEBYTECODE=1 python3 -m unittest test_journey -v