NK-WP-0048-T06: roll out identity-provisioner main-630ebfd

Founder-approved. Image only (kubectl set image); service groups ensure/revoke
present in the running pod, readyz 200. Rollback digest recorded in the workplan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469893@bnt-lap001
Assistant-Session: 49296f15-2171-4137-b972-2443bab95edb

sso-mfa/k8s/identity-provisioner/deployment.yaml

@@ -24,7 +24,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: provisioner
-          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:ffacd5d790a5b7800e0535f3aa95b7de52c7a68e4f575b9192c3e1622fa672c2
+          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:bafb48604d60f8bb98f58d27019df21d17966efcb742cfc11a6a5ab87f3f9d1f
           imagePullPolicy: IfNotPresent
           ports: [{name: http, containerPort: 8080}]
           env:

workplans/NK-WP-0048-security-case-types.md

@@ -352,6 +352,16 @@ railiance-platform's `keycape-client-secret-generate` lane (asked by ops-mason
 `789feb39` and ops-warden `d9f889b1`, both unread), and a founder-approved
 identity-provisioner rollout containing 630ebfd.
 
+2026-10-09: identity-provisioner rolled out, founder-approved in session:
+`main-630ebfd` (`sha256:bafb4860…`, built by the image workflow) replaces
+`main-6c4fcaf` (`sha256:ffacd5d7…`; only change: 630ebfd, additive). Applied
+with `kubectl set image` on the Deployment only (generation 17 → 18, 1/1 Ready);
+the file's Service, NetworkPolicies and Ingress were not reapplied. Verified in
+the pod: `ensure_service_groups` and `revoke_service_groups` present, `/readyz`
+200; no token used, no group changed. Rollback: `kubectl -n sso set image
+deploy/identity-provisioner provisioner=forgejo.coulomb.social/coulomb/identity-provisioner@sha256:ffacd5d790a5b7800e0535f3aa95b7de52c7a68e4f575b9192c3e1622fa672c2`.
+The pin in `sso-mfa/k8s/identity-provisioner/deployment.yaml` follows.
+
 ```task
 id: NK-WP-0048-T07
 status: wait