NK-WP-0056-T06: executor waits for every endpoint; errors named by phase, never mislabelled as no-effect

Two live runs of BEA-2026-0002 ended setup:URLError while four read-only diagnostic pods (same
image, labels, mounts and config) reached every endpoint. Likely cause: a fresh Job pod reaches
OpenBao before the sso/approval-engine ingress rules admit it (NetworkPolicy is programmed per
destination). Now:
- build waits until OpenBao, KeyCape, approval-engine, audit-core and LLDAP all answer HTTP
  (one shared 30 s budget); an unreachable one is named: setup:<name> not reachable.
- a preflight error is a refusal named preflight_error:<Type> (preflight has no effect).
- an error in the consume read-back is outcome unknown, consume_unconfirmed:<Type>, alerted;
  before, any exception after setup was reported as 'refused, no effect' even after consume.
- any other escaping error after setup is outcome unknown (exit 5), never 'no effect'.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350

bounded-executor/executor.py

@@ -354,6 +354,9 @@ class Run:
             self.preflight()
         except Refused as refusal:
             return {"outcome": "refused", "reason": str(refusal), "run_id": None, "effects": False}
+        except Exception as error:  # preflight has no effect: an error there is a refusal, named by its type
+            return {"outcome": "refused", "reason": "preflight_error:" + type(error).__name__, "run_id": None,
+                    "effects": False}
         if self.d.should_stop():  # the founder's stop before the one irreversible act: nothing is spent
             return {"outcome": "refused", "reason": "stopped_before_consume", "run_id": None, "effects": False}
         self.start_wall, self.start_mono = self.d.wall(), self.d.monotonic()
@@ -362,6 +365,10 @@ class Run:
         except Refused as refusal:  # consumed or not, nothing else may happen now
             self.d.alert("consume_unconfirmed", {"admission": self.spec["id"], "run_id": self.run_id})
             return {"outcome": "refused", "reason": str(refusal), "run_id": self.run_id, "effects": "consume-only"}
+        except Exception as error:  # the read-back failed: whether the approval is spent is not established
+            self.d.alert("consume_unconfirmed", {"admission": self.spec["id"], "run_id": self.run_id})
+            return {"outcome": "unknown", "reason": "consume_unconfirmed:" + type(error).__name__,
+                    "run_id": self.run_id, "effects": "consume-unknown"}
         try:
             self.d.audit.emit(self._event(STARTED, {
                 "receipt_version": RECEIPT_VERSION, "run_id": self.run_id, "admission": self.spec["id"],