NK-WP-0056-T13 (part): executor CLI, clients, Containerfile, image workflow

CLI entry point and approval-engine/audit-core clients; events carry
occurred_at (audit-core envelope); hash-locked image with pinned lldap
stage builds locally; image workflow and executor tests in CI; pilot
example pins the executed files. rapp reshaping still open.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

examples/bounded-execution-admission/bind-split-switch-super-admin.yaml

@@ -43,7 +43,7 @@ spec:
   plan:
     source:
       repo: net-kingdom
-      commit: 3b1abc405423
+      commit: fe18096aa398
       files:
       - path: sso-mfa/k8s/lldap/bind-split.py
         sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
@@ -97,7 +97,7 @@ spec:
         scope: k8s/sso/deployment/lldap
       checks_after:
       - synthetic-journey
-  plan_digest: sha256:78e9b24a77955c0b7372d6733e8a6b4da17656eb5a9100a416c4d73eef981d6f
+  plan_digest: sha256:f9ff4e81d9e998e709a2aa41b938d595cf671a1bbd0a43e157de572889b07218
   checks:
   - id: ld-admin-administers
     description: ld-admin signs in and administers; admin keeps lldap_admin membership