Promote NK-IN-0001/0002 after scope/intent review into a single ready workplan (LLDAP operator group, membership runbook, Authelia domain rules, live verification). Hub workstream and tasks registered via fix-consistency.