Adopt live flex-auth digests, record rename answers and NK-WP-0033 ruling

- runtime.yaml: declare the live flex-auth tenant-engine/user-engine digests
  confirmed by flex-auth, and mark the file reference-only (do not apply):
  live is ahead of it beyond the digests, including caller-auth enforce.
- NK-WP-0039: T02 answered (package coordinate unchanged), T03 narrowed,
  new T04 to retire or reconcile the stale reference manifest.
- NK-WP-0033: record the operator's predecessor-disposition ruling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e

workplans/NK-WP-0033-keycape-secret-exposure-rotation.md

@@ -10,7 +10,7 @@ owner: codex
 topic_slug: net-kingdom
 planning_priority: P0
 created: "2026-08-23"
-updated: "2026-08-23"
+updated: "2026-09-23"
 origin: routed
 origin_ref: "State Hub message 8cc44a39-683c-4fab-80dd-b2275d0728e0"
 related:
@@ -219,3 +219,15 @@ is why each partial fix appeared to change nothing.
 Remaining before T05 can close: a green receipt from the repaired script, and a
 ruling on whether a predecessor disposition observed but not receipted is an
 acceptable close for this incident.
+
+### Operator ruling 2026-09-23 — predecessor disposition
+
+The operator (Bernd Worsch) accepted the two recorded observations from
+2026-08-27 as the disposition of the exposed LLDAP predecessor: the WebUI
+lockout, and the `--check` run that passed `predecessor-denial`. A receipt
+cannot be produced because the value is unrecoverable. The incident closes
+once `reconcile-lldap-resolver-live.sh --check` emits a green receipt, and
+nothing else is required.
+
+The custody gap (rotation does not retain the outgoing value) is a
+rotation-runbook fix. It is not a reason to reopen this incident.