[dotnetpower]

Summary

• return a secret-free configured: false Teams Workflow projection when optional deployment-owned binding storage is absent
• keep reveal and every write fail-closed until the deployment provides the store
• document the read contract in both interface owners and refresh the System Knowledge catalog
• distinguish the fixed read-path failure from external prerequisites that must remain explicit rather than synthetic

Measured evidence

• authenticated Lite route audit identified the Teams binding metadata read as the remaining avoidable HTTP 503
• deployed analyzer run after minimum-scope Log Analytics/Event Hubs identity binding: 109 candidates, 5 evaluated, 2 findings, 104 held, 2 published, 0 publication failures, 0 analyzer errors

Validation

• uv run pytest -q services/operator-service/tests/test_operator_iam_family.py — passed, 63 tests
• uv run ruff check services/operator-service/src/fdai_operator_service/families/iam/settings.py services/operator-service/tests/test_operator_iam_family.py — passed
• uv run mypy — passed, 4,150 source files
• bash scripts/verify.sh --fast --diff origin/main...HEAD — passed
• FILE_LOC_MODE=enforce bash scripts/quality/architecture/check-file-loc.sh — passed, 0 failures
• SUBSYSTEM_FANOUT_MODE=enforce bash scripts/quality/architecture/check-subsystem-fanout.sh — passed, 0 failures
• bash scripts/quality/repository/check-doc-links.sh — passed, 0 broken links
• repository pre-push validation — passed

Operational caveats

• Teams/Slack endpoints, an independent T2 secondary publisher, and browser notification permission still require provider/operator configuration.
• Trial activation remains unchanged because the deployment's original installation binding and creation anchor are unavailable; this PR does not invent or renew entitlement evidence.
• Measured Chaos remains absent because no fault-injection authorization was supplied.

Refs #2999