feat(deploy): register managed platform runtime components

infra/authentik/bootstrap-dev.py

@@ -27,6 +27,13 @@ GROUP_SPECS = [
     ("nodedc:taskmanager:admin", False),
     ("nodedc:taskmanager:user", False),
     ("nodedc:bim:access", False),
+    # Module Foundry roles travel through the existing Authentik `groups`
+    # claim and Launcher handoff. `access` remains a backward-compatible
+    # member role until every existing assignment is migrated.
+    ("nodedc:module-foundry:admin", False),
+    ("nodedc:module-foundry:user", False),
+    ("nodedc:module-foundry:blocked", False),
+    ("nodedc:module-foundry:access", False),
 ]
 
 APP_SPECS = [
@@ -121,7 +128,11 @@ def ensure_user_groups(groups):
     user.groups.add(authentik_admins)
 
     for name in groups:
-        user.groups.add(groups[name])
+        # The bootstrap owner must remain capable of entering Foundry after
+        # the first provisioning run. Blocking is an explicit operator action,
+        # never a default membership of the bootstrap principal.
+        if name != "nodedc:module-foundry:blocked":
+            user.groups.add(groups[name])
     return user