NK-WP-0056-T13 (part): executor CLI, clients, Containerfile, image workflow

CLI entry point and approval-engine/audit-core clients; events carry
occurred_at (audit-core envelope); hash-locked image with pinned lldap
stage builds locally; image workflow and executor tests in CI; pilot
example pins the executed files. rapp reshaping still open.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

.forgejo/workflows/identity-journeys.yaml

@@ -2,7 +2,7 @@ name: Identity provider journey acceptance
 on:
   push:
     branches: [main]
-    paths: ["identity-provisioner/**", "sso-mfa/k8s/synthetic-journey/**", ".forgejo/workflows/identity-journeys.yaml"]
+    paths: ["identity-provisioner/**", "sso-mfa/k8s/synthetic-journey/**", "bounded-executor/**", "tools/bounded-execution-admission/**", "examples/bounded-execution-admission/**", ".forgejo/workflows/identity-journeys.yaml"]
   workflow_dispatch:
 jobs:
   provider:
@@ -23,3 +23,9 @@ jobs:
           set -eu
           cd identity-source/sso-mfa/k8s/synthetic-journey
           PYTHONDONTWRITEBYTECODE=1 python3 -m unittest test_journey test_lane -v
+      - name: Run bounded executor tests (NK-WP-0056-T11..T13)
+        run: |
+          set -eu
+          cd identity-source
+          python3 -m pip install --no-cache-dir --require-hashes -r bounded-executor/requirements.txt
+          PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s bounded-executor/tests -v