Implements Task 6. Guards user creation with :if [find]; disables the built-in
admin (switch_disable_default_admin) now that sjat key login is proven. Verified
run-twice idempotent (changed=0); admin disabled=true, sjat reachable on bench.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>