Which kubeadm-generated kubeconfig holds an identity that skips the authorization layer, RBAC included?

Answer: A. super-admin.conf

super-admin.conf carries a certificate in system:masters, a break-glass group that bypasses authorization. It is recommended to move it somewhere safe rather than leave it beside admin.conf.

Source: Creating a cluster with kubeadm (Kubernetes) — Initializing your control-plane node