Prepare native isolated directory recovery and offline service images

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

registry/capabilities/capability.security.bootstrap-recovery.md

@@ -73,6 +73,8 @@ availability:
   - tools/bootstrap-recovery/retrieve-identity-offline.py
   - tools/bootstrap-recovery/recovery-kit.py
   - tools/bootstrap-recovery/run-offline-recovery.sh
+  - tools/bootstrap-recovery/isolated-lldap.py
+  - tools/bootstrap-recovery/run-isolated-lldap.sh
   - docs/disaster-recovery-storage-share.md
   - docs/identity-service-restore-packet.md
   - docs/storage-share-recovery-publication.md
@@ -103,6 +105,7 @@ evidence:
   - tests/test_identity_offsite.py
   - tests/test_identity_backup_preparation.py
   - tests/test_identity_offline_recovery.py
+  - tests/test_isolated_lldap_recovery.py
 consumer_guidance:
   recommended_for:
   - Operator recovers identity, custody or data with independently held recovery material
@@ -158,3 +161,10 @@ and independent outage-path archive recovery passed on 2026-10-16; T23/T26 are
 done. See [the published location and trusted kit digest](../../docs/storage-share-recovery-publication.md).
 The [isolated service packet](../../docs/identity-service-restore-packet.md)
 records the remaining service-owner admission and native tests.
+
+The local LLDAP stage now has a fixed-target executor with no external network,
+ports or host mounts, Linux-tmpfs plaintext, original directory/key preservation,
+native existing-user/wrong-password checks and cleanup. Six actual-image tests
+with synthetic credentials passed, including an encrypted-bundle restore. All
+five pinned service images were saved/reloaded locally. T28/T29 record that
+preparation; actual private real-backup LLDAP acceptance remains T16.