Harden ops run identity and leases

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

docs/adr/adr-005-ops-runs-vs-dev-work-records.md

@@ -96,13 +96,20 @@ When a definition emits a TaskSpec for internal fleet work:
 3. Do **not** open a Forgejo issue.  
 4. Do **not** create a workplan task file for that day’s fire.
 
-Claim API (sketch; implement in ACTIVITY-WP-0026):
+Claim API (implemented in ACTIVITY-WP-0026 and hardened in
+ACTIVITY-WP-0036):
 
 - `POST /ops-runs/claim` — lease next open run matching labels / worker id  
 - `POST /ops-runs/{id}/complete` — succeeded + completion metadata  
 - `POST /ops-runs/{id}/fail` — failed + retry policy  
 - `GET /ops-runs?state=open` — operator visibility  
 
+Worker mutation credentials are bound to one configured queue `worker_id`;
+the request body cannot assert a different claim owner. Heartbeat, completion,
+and failure lock the row and require its lease deadline to remain strictly in
+the future. Operator/SSO credentials provide visibility and explicit
+administration, but do not act as a normal worker identity.
+
 activity-core remains **when / what / where** only: it does **not** run
 domain LLM sessions or hold tenant git credentials.