NK-WP-0056-T09 done: syn-journey live, synthetic journey passes at aal2

Founder-run under CCR-2026-0057: KeyCape client registered, lane.py setup
(privacyIDEA-generated key, KV v1) and verify passed; the live journey
reached aal2 with otp against kc.coulomb.social. Receipts, findings and the
one teardown of a partial run in docs/evidence. syn-journey declared active.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

tools/service-identity/declarations/lldap.yaml

@@ -94,7 +94,7 @@ identities:
     consumers: [{name: synthetic-journey, kind: service}]
     owner: "NetKingdom directory and User Engine owners"
     rotation: {path: "lane.py teardown then setup (CCR-2026-0057); password and TOTP seed together", coupling: [privacyidea]}
-    status: planned
+    status: active
 exceptions:
   - id: SI-X6
     rules: [SI-3]