NK-WP-0054-T05: pin identity-provisioner image with LLDAP_ADMIN_USERNAME support

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56

sso-mfa/k8s/identity-provisioner/deployment.yaml

@@ -24,7 +24,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: provisioner
-          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:bafb48604d60f8bb98f58d27019df21d17966efcb742cfc11a6a5ab87f3f9d1f
+          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:6d1f3632221e6f9d3f5ea41fea1c7e143033f34d2f8777a29af967cfbc9e4199
           imagePullPolicy: IfNotPresent
           ports: [{name: http, containerPort: 8080}]
           env:

sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md

@@ -40,7 +40,7 @@ mkdir -p -m 700 ~/nk54
    version), set `image:` in `sso-mfa/k8s/lldap/deployment.yaml` to
    `docker.io/lldap/lldap@sha256:9e605a66…09d` and commit. **If it is anything else, stop**: the
    rehearsals must be rerun on that digest first; never pin to an older version.
-3. **Provisioner image** built from commit `2ebc4f0` or later through its owner pipeline (it reads
+3. **Provisioner image.** Done 2026-10-29: `sha256:6d1f3632…4199`, built by the Forgejo workflow from `main` after `2ebc4f0`, is pinned. Originally: built from commit `2ebc4f0` or later through its owner pipeline (it reads
    `LLDAP_ADMIN_USERNAME`). Put its digest in `sso-mfa/k8s/identity-provisioner/deployment.yaml` and
    commit. Do not deploy it yet.