LDAP source (FreeIPA): membership for newly created groups never syncs (users_obj stays empty)

**Describe the bug**
When a *new* group is created in FreeIPA (with members) and the LDAP source is synced, the group **object** propagates to authentik correctly, but its **user membership stays empty** (`users_obj: []`) — even after multiple sync runs, and regardless of the `lookup_groups_from_user` setting. Pre-existing groups with pre-existing members keep working; only newly created groups hit this.

First verified on 2025.10.4 (2026-05-13) and re-verified after upgrading to **2026.5.3** (2026-07-06) with a scripted end-to-end test, so it does not appear to be version-specific.

**To Reproduce**
1. LDAP source against FreeIPA (`ldaps://`), working user+group sync (existing groups/members correct).
2. In FreeIPA: `ipa group-add repro-group` and `ipa group-add-member repro-group --users=`.
3. Trigger the LDAP sync schedule (`POST /api/v3/tasks/schedules//send/` for `authentik.sources.ldap.tasks.ldap_sync:`), repeat a few times.
4. `GET /api/v3/core/groups/?name=repro-group&include_users=true`.

**Expected behavior**
`users_obj` contains the two members.

**Actual behavior**
The group appears (with correct `distinguishedName` / `attributes.ldap_uniq`) but `users_obj` stays `[]` across repeated sync runs (observed to persist indefinitely on 2025.10.4; re-confirmed over a 4-minute poll window on 2026.5.3). Manually PATCHing `/api/v3/core/groups//` with `users=[]` works as a workaround.

Observed with both `lookup_groups_from_user: true` and `false`.

**Version and Deployment**
- authentik version: 2026.5.3 (docker-compose, tag-pinned; previously 2025.10.4 — same behavior)
- Deployment: docker-compose, embedded outpost only
- LDAP source: FreeIPA (RHEL IdM / 389-ds), dedicated read-only bind account, LDAPS with CA verification

**Additional context**
A plausible mechanism (speculation): the sync processes user pages and group pages such that membership linkage for a group created *after* the users were last synced never gets established — existing users are not re-evaluated against the new group. Happy to run patched builds or provide sync task logs if useful.