Active user attribute set, latest activities, guarded changes to used values, artefact links, durations and averages; irreversible showcase step

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

docs/maturity-and-projects.md

@@ -132,6 +132,15 @@ Every attribute has:
 
 Values are never secret (`secret` is not allowed; secret markers are refused). Only references to secrets are allowed.
 
+### The active user: `user-attributes`
+
+One attribute set lives in the app rather than in any project: `user-attributes`, holding the active user's `operator` (one word) and an
+optional `display_name`. It comes from the `RTUT_USER` environment variable, else from the user's saved settings (`/user` page,
+`~/.config/runbook-tutorials/user-attributes.yaml`), else from the operating-system login. Forms that used to ask "your name" (starting a
+run, reviewing a runbook, starting a project run) show who you are running as and link to that page. Any project can reuse the set
+(`attribute_sets: [user-attributes]`); a repository may define its own set of that id, which then takes precedence. If the UI later runs
+behind a login, the login fills the same attribute.
+
 ### Layers, in order (later wins)
 
 attribute sets listed by the project (each after its own `extends`) then the project's own `attributes`, then the target's