othala v0.6.1 Evidence release: the login-tier logic that 0.5.0's outage slipped past is now proven against the captured production flow on every push, passkey eviction is corrected to the model Kratos actually allows, and e2e keeps its evidence. - **Passkey eviction is self-service, never an admin action.** Kratos refuses an admin DELETE of a passkey credential (400, upstream default), so the admin UI no longer offers it. The documented path is contain, recover, self-remove, delete-identity; the e2e P-block proves the real eviction (the victim removes the lost passkey in settings, the other session survives). - Login tier derivation extracted into `deriveLoginTiers`, unit-tested against the real captured production flow and mutation-proven red on the 0.5.0 logic. - Auth pages share one panel style; both admin user forms share one script component; `isSessionFresh` drops a guard that never changed the outcome. - e2e renders the login journey in a real browser and hard-asserts all three tiers; passkey login is no longer fixme'd; CDP ceremonies wait deterministically; the N2 scrape retries then fails instead of skipping. - e2e runs on MR, main and tag pipelines; verify and lint ride api pipelines so a lever run can never read greener than the push; flaky-then-green runs keep their first-attempt artifacts. - The DOS-2 flood test carries a 60s budget: 8-9s on a SaaS small runner, 27s under contention, which reddened a green merge.