Surface redacted directory bind failures before native onboarding

Map uncaught HTTPError from LLDAP login to a structured
dependency_unavailable response, add /readyz as the provisioner-to-directory
preflight, keep /healthz as process liveness, and run the contract in CI.
Auth rejection is not retried during cooldown.

NK-WP-0036-T05 remains in progress until the immutable image is published,
pinned with /readyz, and one native login/create/password-setup journey is
verified.

Assistant: grok
Assistant-Session: 01a09dc6-3f0e-78f1-a884-c8c703c24ddf

sso-mfa/k8s/identity-provisioner/deployment.yaml

@@ -45,6 +45,9 @@ spec:
           resources:
             requests: {cpu: 25m, memory: 32Mi}
             limits: {cpu: 250m, memory: 128Mi}
+          # /healthz is process liveness only. After the T05 image is pinned,
+          # switch readiness to /readyz (timeoutSeconds >= 5) so a rejected
+          # directory bind takes the pod out of Service endpoints.
           readinessProbe:
             httpGet: {path: /healthz, port: http}
             periodSeconds: 10