fix: validate sandbox consumer actors early

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b

docs/harness-contract.md

@@ -15,6 +15,14 @@ title, and description. It may carry correlation and organizational references
 leadership/workforce records; they do not transfer organizational authority to
 Glas.
 
+`actor` is the governed sandbox consumer type and must be `adm`, `agt`, or
+`atm`. It is not a worker instance identifier. Queue consumers retain values
+such as `rein-aharness@railiance01` as upstream `worker_id` ownership metadata
+and map governed agent execution to `actor="agt"`. Glas validates this before
+sandbox creation and returns a normalized `resolution` refusal for invalid
+channel/library requests; the CLI rejects invalid choices during argument
+parsing.
+
 The gateway returns `GatewayResult` with:
 
 - `ok`, derived from normalized outcome;