docs(lab-01): complete secure evidence package

[haydarkozat]

Summary

Prepares the remaining LAB-01 evidence package without publishing tenant or account identifiers.

Already complete and documented

• seven baseline security groups created
• second execution returned Existing / None for all seven groups
• idempotency result recorded in the technical baseline summary
• pilot scopes for Conditional Access and Intune established

Added in this PR

• exact five-artifact evidence manifest
• secure screenshot/capture and redaction runbook
• machine-checkable idempotency validation
• least-privilege RBAC matrix
• public, secrets-free break-glass concept
• reconciled LAB-01 status and cross-links

Remaining operator evidence

• LAB-01-01-tenant-overview.png
• LAB-01-02-baseline-groups.png
• LAB-01-03-whatif.png (original evidence only)
• LAB-01-04-created.png (original evidence only)
• LAB-01-05-idempotency.png
• mark all five rows Captured and redacted in the manifest
• change LAB-01 status to Complete

Security review

Automated text checks found no e-mail addresses, GUIDs, secret assignments, tenant IDs or object IDs in the changed documentation. The capture guide explicitly suppresses identity fields and requires local visual inspection before commit.

This PR is intentionally a draft until all five genuine, redacted screenshots are added. Historical evidence must not be recreated or staged.