Pin identity-provisioner main-6c4fcaf (password-setup usability) as deployed

Operator-applied 2026-09-24; healthz/readyz 200, username field and
sign-in URL live. Rollback: sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e

sso-mfa/k8s/identity-provisioner/deployment.yaml

@@ -24,7 +24,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: provisioner
-          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c
+          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:ffacd5d790a5b7800e0535f3aa95b7de52c7a68e4f575b9192c3e1622fa672c2
           imagePullPolicy: IfNotPresent
           ports: [{name: http, containerPort: 8080}]
           env:

workplans/NK-WP-0041-onboarding-journey-usability.md

@@ -22,7 +22,7 @@ items in this repository are implemented here.
 
 ```task
 id: NK-WP-0041-T01
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "82ce581a-b635-5b5b-9b08-91b61e7eb9bd"
 ```
@@ -40,9 +40,20 @@ source is fixed in `identity-provisioner`:
 - The completion page still does not show the login name, as an existing
   test requires.
 
-Four new HTTP tests cover this, and the 32 provisioner tests pass. Remaining:
+Four new HTTP tests cover this, and the 32 provisioner tests pass.
-publish through the identity-provisioner image lane, then promote the digest
+
-with operator approval.
+Released on 2026-09-24. CI published `main-6c4fcaf` as
+`identity-provisioner@sha256:ffacd5d7…`, and the operator applied the
+declaration on railiance01. Only the image and the new env changed; the
+other resources were unchanged. The new pod checks out:
+
+- `/healthz` returns 200 and `/readyz` returns 200 (`dependency: directory`).
+- An invalid setup link returns 400.
+- The served code carries the `autocomplete="username"` field.
+- `PASSWORD_SETUP_SIGNIN_URL` is set.
+
+Rollback digest: `3317a261…`. The next real setup link will show the field
+to a user; note it here if the password manager still misbehaves.
 
 ## Plus-addressed email sign-in fails with an LDAP filter error