AUDIT-WP-0018-T04: align seed with settled CCR-2026-0063 (railiance-platform f3b0c4f)

- sso delivery is ExternalSecret/Secret sso/bounded-executor-tokens key
  audit-core (the Secret the rapp run Job already mounts), not
  nk-bind-executor-audit/audit-token.
- CCR check now also pins the new reader shape (audience openbao, explicit
  max TTL 15m, token_self_lifecycle) and that the CCR names this script as
  its custody procedure and the bounded-executor-tokens delivery.
- Docs/workplan: this script is the single seeder; railiance-platform
  fences the boundary (nk_bind_executor_custody.py fence) and owns
  manifests/nk-bind-executor-eso.yaml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350

tests/test_seed_nk_bounded_executor_sender.py

@@ -192,6 +192,18 @@ def test_ccr_contract_as_drafted_matches_and_refuses_until_approved():
     moved["openbao"]["kv_path"] = "platform/workloads/net-kingdom/other"
     with pytest.raises(SEED.Refused, match="ccr_custody_contract_mismatch"):
         SEED.check_ccr(moved)
+    old_reader = approved_ccr()
+    del old_reader["openbao"]["auth"]["audience"]
+    with pytest.raises(SEED.Refused, match="ccr_reader_shape_mismatch"):
+        SEED.check_ccr(old_reader)
+    old_delivery = approved_ccr()
+    old_delivery["delivery"]["target"] = "Secret sso/nk-bind-executor-audit, key audit-token"
+    with pytest.raises(SEED.Refused, match="ccr_delivery_mismatch"):
+        SEED.check_ccr(old_delivery)
+
+
+def test_sso_delivery_is_the_secret_the_run_job_mounts():
+    assert (SEED.SSO_SECRET, SEED.SSO_KEY) == ("bounded-executor-tokens", "audit-core")
 
 
 def test_wrong_confirmation_refuses_before_any_call(tmp_path, monkeypatch):