NK-WP-0056-T03 done: executor identity and authority ceiling, in source

Executor credentials declared (planned) with executor_subject; service-identity
gains convention executor (SI-15: approved-only grants, no person, not
interactive) and --admissions, checking that an admission's ceiling lies inside
the executor's declared grants (pilot covered). RBAC in sso-mfa/k8s/bounded-executor
(not applied): ServiceAccount without automount, a Role limited to the authelia
Deployment and ExternalSecret, no read of credential objects; tests tie Role,
declaration and pilot ceiling. The pilot example's delivery check now reads the
ExternalSecret status. railiance-apps and glas-harness answers recorded (T02).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

examples/bounded-execution-admission/bind-split-switch-super-admin.yaml

@@ -43,7 +43,7 @@ spec:
   plan:
     source:
       repo: net-kingdom
-      commit: b8d3dacc4195
+      commit: 43a78907593a
       files:
       - path: sso-mfa/k8s/lldap/bind-split.py
         sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
@@ -93,7 +93,7 @@ spec:
       requires:
         mode: OPERATE
         scope: k8s/sso/deployment/lldap
-  plan_digest: sha256:c15793ccaad212eaf24de12a1d13709970be84ee917a994463b68880e905dedf
+  plan_digest: sha256:60578e013b23fd3d68fead65956c939cde1eb9230d9f9fdbe1aaa677e8e0de11
   checks:
   - id: ld-admin-administers
     description: ld-admin signs in and administers; admin keeps lldap_admin membership