dd59bf592f
A legacy binding from plan 15-06 has ldapDn set but ldapObjectGuid stays null until the first syncBoundGroupsForTenant() run backfills it. Until then, GroupsService.update() let a direct PATCH rename through even though GroupFormModal.tsx already treats the same group as AD-bound (isImported = ldapDn != null) — the D-03 name lock was only a UI convention for that window, not the backend invariant the 16-02 summary claimed.