NK-WP-0054-T02: agent ceiling is 60 minutes; ld-admin is LLDAP-only and admin stays the human's name

Founder clarifications: the SI-14 token ceiling is 60 minutes (3600 s); ld-admin is for
LLDAP only and the name admin remains the human platform administrator's wherever it
appears. The LLDAP rehearsal is now introducing ld-admin by configuration and demoting
admin, not renaming. The validator rejects a service-admin named admin.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed

tools/service-identity/declarations/lldap.yaml

@@ -29,7 +29,7 @@ identities:
     recovery: {needed: true, works_with_sso_down: false, in_crisis_list: true}
   - name: ld-admin
     classes: [service-admin]
-    purpose: "Proposed: LLDAP's own administrator, separate from every bind and every person (renaming needs a rehearsal)"
+    purpose: "LLDAP only: the directory's configured super-admin, separate from every bind and every person; introduced by configuration after a rehearsal"
     privilege_level: admin
     interactive_login: true
     second_factor: unknown