Surface redacted directory bind failures before native onboarding

Map uncaught HTTPError from LLDAP login to a structured
dependency_unavailable response, add /readyz as the provisioner-to-directory
preflight, keep /healthz as process liveness, and run the contract in CI.
Auth rejection is not retried during cooldown.

NK-WP-0036-T05 remains in progress until the immutable image is published,
pinned with /readyz, and one native login/create/password-setup journey is
verified.

Assistant: grok
Assistant-Session: 01a09dc6-3f0e-78f1-a884-c8c703c24ddf

.forgejo/workflows/identity-journeys.yaml

@@ -10,7 +10,7 @@ jobs:
     container:
       image: python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
     steps:
-      - name: Test the exact commit
+      - name: Run provider and directory-contract tests
         run: |
           set -eu
           mkdir -p identity-source

.forgejo/workflows/identity-provisioner-image.yaml

@@ -0,0 +1,54 @@
+name: Build and Publish identity-provisioner
+
+# Fleet image-publish pattern: build from a tarball of the pushed commit,
+# never from a workstation tree. Contract tests run in identity-journeys.yaml
+# on the same paths; do not promote a digest if that job failed.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "identity-provisioner/**"
+      - ".forgejo/workflows/identity-provisioner-image.yaml"
+  workflow_dispatch:
+
+env:
+  REGISTRY: forgejo.coulomb.social
+  IMAGE_NAME: coulomb/identity-provisioner
+  DOCKER_HOST: tcp://127.0.0.1:2375
+
+jobs:
+  build-and-push:
+    runs-on: container-build
+    steps:
+      - name: Build and push image
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -eu
+          REF="${GITHUB_SHA:-main}"
+          SHORT="${REF:0:7}"
+          mkdir -p buildctx "${HOME}/bin"
+          wget -qO /tmp/repo.tar.gz \
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
+          tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
+          wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
+            | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
+          export PATH="${HOME}/bin:${PATH}"
+          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
+          docker build -f buildctx/identity-provisioner/Containerfile \
+            -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" \
+            buildctx/identity-provisioner
+          docker push "${IMAGE}:latest"
+          docker push "${IMAGE}:main-${SHORT}"
+          echo "pushed ${IMAGE}:latest and ${IMAGE}:main-${SHORT}"
+
+      - name: Report immutable digest
+        run: |
+          set -eu
+          export PATH="${HOME}/bin:${PATH}"
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
+          SHORT="${GITHUB_SHA:0:7}"
+          docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:main-${SHORT}"