D13 / wave 10 - the decision and the task file, before any code

Authentication moves to the domain over LDAPS. Nothing in the spec covered
auth against a directory, so per CLAUDE.md this is new scope with a new `D`
id rather than a widened old one. D1-D12 were taken.

Records what was verified against the live environment on Aug 21 rather than
assumed: LDAPS on 636 with TLS 1.3, the DC cert chain up through PRIME
CONTROLS ISSUING CA 1 to a root valid until 2051, six DCs in the SRV record,
and `prime.local` in every DC cert's SAN - which is why the client connects
to the domain name and not to a DC or an IP.

Also records why the certificate already serving the site is not usable for
this: it is a Let's Encrypt DV cert held by an OpenResty host outside this
repo, and it carries no relationship to prime.local. The question was asked
directly and the answer is not obvious, so it belongs in the record.

Eight tasks, T10.1 through T10.8. Two questions are left open in the decision
doc to be answered rather than guessed - break-glass access when the DC is
unreachable, and whether existing usernames match sAMAccountName.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

IMPLEMENTATION.md

@@ -89,6 +89,11 @@ be built as written, or cannot be built once, until something else lands.
 | 7 | The creator | `docs/waves/wave-7.md` | `B7` `A1` `CR-015` `A2` `A6` `CR-014` `CR-007` `B6` `S1`(creator) `F6` `D1` `D2` `D3` `D4` `D5` `D8` `D9` `D10` |
 | 8 | Kitting and material | `docs/waves/wave-8.md` | `CR-009` `CR-010` `CR-011` `CR-012` `CR-013` `D6` `D10` |
 | 9 | Verification and cleanup | `docs/waves/wave-9.md` | `CR-008` `CR-017` `S6` `S7` `C1` `C2` `C4` `D7` |
+| 10 | Domain authentication over LDAPS | `docs/waves/wave-10.md` | `D13` |
+
+Wave 10 was added on August 21, 2026 and is not part of the original nine-wave sequence. It
+is new scope (`docs/waves/decisions-2026-08-21.md`), not a reinterpretation of anything
+above, and it depends only on wave 9 being merged rather than on any particular item in it.
 
 **Waves 1 through 4 produce almost no field-visible change.** That is deliberate and it is
 roughly the first third of the effort. It is called out here because the Micron team is