Use a dedicated group instead of adding the service to the real family
or administrator groups. The browser OAuth client remains separate.
Public identity metadata and its future verifier configuration share one
canonical declaration; the migration contains no credential material.
Verified the actual guest migration payload, 12 Nix contracts, and two
mock-provider tests using the real service verifier on the pinned Node
runtime. Formatting passes. Active Nix LSP checks found no diagnostics;
one probe was inconclusive, so it is not counted as clean.
The migration has not been applied to a live or disposable Kanidm server.
No API token was minted, no bridge unit was enabled, and no production
host was deployed. Verify directory state before enabling the transport.
64cb8e337f
