feat(recovery): verify scoped delivery and create first full offsite bundle

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

registry/capabilities/capability.security.bootstrap-recovery.md

@@ -104,13 +104,14 @@ consumer_guidance:
     or recovery
   - 2026-10-14 architecture review estimates operational maturity separately; a registry
     entry does not authorize execution or establish deployment.
-  - Identity backup implementation passed 49 focused checks including synthetic age/native
-    PostgreSQL recovery; new CCR-2026-0048/0049 grants and first actual full bundle
-    remain pending owner admission.
   - Actual old privacyIDEA database recovery passed; full token decryption, audit
     continuity and directory/issuer authentication remain open.
   - Storage Share initial destination only; no second-provider full identity copy
     or autonomous bare-VM restore is established.
+  - Actual first full identity bundle captured, sealed and Storage Share readback
+    verified on2026-10-16; both scoped readers passed native identity/namespace/audience/ESO
+    checks. Independent human-key full archive proof and complete service authentication
+    remain pending.56 focused implementation checks pass.
 ---
 
 # Guarded bootstrap and recovery preparation