AUDIT-WP-0018-T03: report bounded-executor runs that started without a receipt

A sender may declare closing_classes; nk-bounded-executor declares
execution.run.started closed by execution.attribution.receipt within
7200s. GET /v1/stream-findings reports opening_without_closing past the
bound, counted from the receiver's accepted_at plus the heartbeat grace
allowance; a per-run data.window.not_after tightens but never extends.
Identifiers and timing only. The overlay may add or shorten, never
remove, rebind or lengthen. Both backends: 403 passed (1 unrelated
live-catalog env failure).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 482098@bnt-lap001
Assistant-Session: 9643c95a-a398-4f4a-b56a-6119be4e845e

tests/test_bounded_executor_sender.py

@@ -147,6 +147,12 @@ def test_scope_entry_is_exact_write_only_reject_load_bearing():
         "may_read": False,
         "secret_policy": "reject",
         "evidence_kind": "load-bearing",
+        "closing_classes": {
+            "execution.run.started": {
+                "closed_by": "execution.attribution.receipt",
+                "within_seconds": 7200,
+            }
+        },
     }