Records on_conflict: fail as standing policy (identity provisioning never links a new upstream identity to an existing local account), the residual prompt-stage uniqueness check, and the SOPS-secret-needs-restart rule. Decided by sorb.
