Operator access

Clerk proves identity for the operator console. MIB still enforces its own allowlist, tenant scope, approval gates, and audit evidence before any command-plane action can run.