Arcade 1.9.6

This release refreshes the bundled application images (appVersion d94d6bd → a2b588e) and applies one coordinator schema change. Its subject is operator RBAC on enterprise-SSO deployments: users provisioned just-in-time through an enterprise identity provider now get roles bound at sign-in, and a new operator CLI repairs members already stranded without them. No chart templates or default values changed. Read the upgrade notes before rolling if you run operator RBAC together with enterprise SSO.

This release applies a coordinator schema change. Migrations run automatically on helm upgrade unless coordinator.database.migrations is false. No engine or experience-api schema changes ship in this release.

• Coordinator — adds an optional per-identity-provider default role. Required: the enterprise-SSO role-binding fix reads it, and reads fail until the column exists. The column is nullable and additive, so rollback is clean.

• An identity provider can declare the operator-RBAC role granted on the default project when an account is provisioned just-in-time: oidc_idp.py create-provider --default-role project_admin|project_member. Left unset it binds least-privilege project_member, which is also the prior behavior for every existing provider — an identity-provider assertion is not treated as an explicit admin grant.
• New repair-operator-authz operator CLI grants operator-RBAC roles to members that hold organization or project membership but no roles anywhere in the organization. Dry-run by default; --commit applies. It is strictly additive and skips any account that already holds a role somewhere in the organization, so deliberate narrowings and revocations survive. --account scopes it to specific accounts.

• Users provisioned just-in-time through enterprise SSO now receive operator-RBAC roles at sign-in. Under an organization with operator RBAC enabled they previously landed with organization and project membership rows but no roles at all: the dashboard returned 403 on every page, and they could not be repaired by re-inviting them (the invitation was rejected as "already a member" before any email was sent). The first member of an organization binds as organization admin; later members bind the provider's configured default role on the default project. Role binding is fail-closed — if the authorization store is unreachable, provisioning rolls back rather than committing a member with no roles.
• The assign-account bootstrap CLI binds operator-RBAC roles as well, so operator bootstrap and recovery match invitation-accept semantics.

• No values.yaml, RBAC, secret, or Kubernetes-version changes. Only the bundled image tags move.
• One coordinator migration, required by the SSO role-binding fix; see Database migrations.
• Two new coordinator CLI surfaces: repair-operator-authz (repair stranded members) and oidc_idp.py create-provider --default-role (choose the just-in-time default role per provider).

• Identity-provider create APIs accept an optional default role.
• Just-in-time provisioning under operator RBAC writes role bindings as part of the same transaction as the membership rows, and fails the sign-in rather than committing a role-less member.