NK-WP-0048-T05: fold ops-warden's review into the type; build memo r3

Canon section 3 defines warden_executes narrowly and adds per-step lane,
value_handling and ready_check; catalog entries need a templated body. The
type gets lanes, generated-in-custody minting, a Ready gate before bind-env,
memberships only from the accepted case, mfa-pinned and secret-delivered
checks, and the R4-prime catalog body. 110 tests pass. Memo r3 supersedes r2
and validates on both sides.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012

tools/security-case-types/tests/test_security_case_validator.py

@@ -183,3 +183,26 @@ def test_bad_condition_is_refused():
     found = msgs(v.validate_type(t))
     assert any("unknown parameter 'nonexistent'" in m for m in found)
     assert any("must be '<parameter> == <value>'" in m for m in found)
+
+
+def test_follow_through_needs_value_handling_and_lanes():
+    t = copy.deepcopy(TYPE)
+    step = t["spec"]["follow_through"][0]
+    del step["value_handling"]
+    del step["lane"]
+    found = msgs(v.validate_type(t))
+    assert any("value_handling" in m for m in found)
+    assert any("catalog lane" in m for m in found)
+
+
+def test_generated_value_never_in_attended_step():
+    t = copy.deepcopy(TYPE)
+    t["spec"]["follow_through"][0]["value_handling"] = "generated_in_custody"
+    assert any("never handled in an attended session" in m for m in msgs(v.validate_type(t)))
+
+
+def test_catalog_entry_needs_a_body():
+    t = copy.deepcopy(TYPE)
+    item = next(m for m in t["spec"]["materialization"] if m["kind"] == "catalog_entry")
+    del item["body"]
+    assert any("catalog entry needs its body" in m for m in msgs(v.validate_type(t)))