fix: validate sandbox consumer actors early

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b

tests/test_gateway.py

@@ -139,6 +139,22 @@ def test_run_execution_refuses_unknown_profile_before_sandbox() -> None:
     manager.create.assert_not_called()
 
 
+def test_run_execution_refuses_worker_identifier_before_sandbox() -> None:
+    manager = MagicMock()
+    request = _request().model_copy(update={"actor": "rein-aharness@railiance01"})
+
+    result = run_execution(request, rein=_FakeRein(), manager=manager)
+
+    assert result.ok is False
+    assert result.evidence.outcome == "refused"
+    assert result.evidence.failure_stage == "resolution"
+    assert result.evidence.error == (
+        "execution actor must be a governed consumer type: adm, agt, or atm; "
+        "queue worker identifiers are not execution actors"
+    )
+    manager.create.assert_not_called()
+
+
 def test_hub_receives_normalized_evidence_without_raw_output() -> None:
     manager = MagicMock()
     manager.create.return_value = _fake_status()