identity: the executor exists; the ceremony does not

The current-state list still said no admission executor existed. It has since
0f8fe22, and a chapter that is the design of record cannot carry a fact that
stopped being true two commits ago.

Says what is actually the case: the executor and the mapping and the per-request
projection are real and packaged, have never run as root outside a scratch
tree, have no ceremony around them, and are missing the worker boundary that
would let any of it read isolated.

saf/identity/02-agent-principal.md

@@ -327,9 +327,16 @@ gives the newly admitted agent an accurate way to use and explain it.
 - the Agent settings diagnostics check IDs and paths, not principal or process
   identity;
 - the server hosts multiple agents inside the human's process and home;
-- no admission executor, per-agent worker boundary, account mapping, account
-  health result, fresh runtime-principal projection, or generated operating
-  skill exists yet.
+- the admission executor exists and is packaged: one writer, the root-owned
+  account mapping, and the runtime principal projection injected per model
+  request. It has never run as root on a real system — every refusal has been
+  proven only against scratch trees;
+- there is no ceremony around it. No polkit action, no step-up, no first-run
+  admission, and no surface anywhere that shows a human the choice. Reaching
+  it requires already knowing its name;
+- no per-agent worker boundary, account health surface, or generated operating
+  skill exists yet. Without the worker, every admitted agent still honestly
+  reads `acting-as-human` and `isolated` is unreachable.
 
 Until those pieces land, the system must say **logical identity present,
 kernel principal absent**. That is the live gap this chapter owns.