Goal: Two Auth Modes

Use Krypton Execution to execute docs/goals/two-auth-modes/PLAN.md.

Core rules:

Treat PLAN.md as the source plan.
Preserve intent, ownership, contract, cutover, evidence, and kill criteria.
Keep exactly two public modes: manual-keychain and bitwarden-auto.
Do not introduce a third first-class user mode; old flags/env may exist only as compatibility shims mapped to one of the two modes.
Manual-keychain stores only LDAP username/password in macOS Keychain and always leaves OTP manual.
Bitwarden-auto preserves the old personal Bitwarden + Touch ID + full autofill/submit path.
Capture acceptance evidence from both checkout source and installed local paths.
Say "implemented but unproven" if installed-path or launch evidence cannot be captured.