Seed LLDAP activity-core-operators, add membership runbook and helper,
restrict Authelia access on activity/temporal.coulomb.social to that
group (member one_factor + domain deny fallback), apply live, and verify
via Authelia check-policy plus unauthenticated edge redirects.
Promote NK-IN-0001/0002 after scope/intent review into a single ready
workplan (LLDAP operator group, membership runbook, Authelia domain rules,
live verification). Hub workstream and tasks registered via fix-consistency.
