NET-WP-0019: register T06-adjacent polish workplan + implement core (orchestrator script, safer secret fallback in create-user, console dry-run + cleanup commands, make targets, cross-link from 0017 T06). See workplan file for task status.

Makefile

@@ -225,6 +225,14 @@ security-bootstrap-lifecycle-guide: ## Print the practical T05 operator flow gui
 security-bootstrap-onboarding-dry-run-template: ## Print non-secret NET-WP-0017-T06 onboarding dry-run evidence JSON template (use to start T06 evidence after running the lifecycle flow)
 	python3 tools/security-bootstrap-console/security_bootstrap_console.py onboarding-dry-run-template
 
+security-bootstrap-onboarding-dry-run: ## Run the T06 non-root dry-run orchestrator (see sso-mfa/k8s/lldap/dry-run-nonroot-user.sh and NET-WP-0019). Usage: make ... SUBJECT=foo EMAIL=foo@ex.com DISPLAY="Foo"
+	@cd sso-mfa/k8s/lldap && \
+	  ./dry-run-nonroot-user.sh $(or $(SUBJECT),t06-dryrun) $(or $(EMAIL),t06-dryrun@coulomb.social) "$(or $(DISPLAY),T06 Dry Run User)" --actor user --scope none
+
+security-bootstrap-lifecycle-cleanup-dryrun-users: ## Clean up dry-run/test users by pattern (NET-WP-0019 T04). Usage: make ... PATTERN=t06-*
+	@cd sso-mfa/k8s/lldap && \
+	  ./dry-run-nonroot-user.sh --cleanup-only "$(or $(PATTERN),t06-*)"
+
 security-bootstrap-validate-custody-roster: ## Validate and verify the signed local custody roster
 	python3 tools/security-bootstrap-console/security_bootstrap_console.py \
 	  validate-custody-roster \
@@ -293,6 +301,8 @@ security-bootstrap-ui: security-bootstrap-metadata-init ## Serve local custody a
         security-bootstrap-lifecycle-flow-template \
         security-bootstrap-lifecycle-guide \
         security-bootstrap-onboarding-dry-run-template \
+        security-bootstrap-onboarding-dry-run \
+        security-bootstrap-lifecycle-cleanup-dryrun-users \
         security-bootstrap-validate-custody-roster \
         security-bootstrap-sign-custody-roster \
         security-bootstrap-approve-custody \