NK-WP-0056-T06 prep: admission helper, write-role window-open/close, service-client case; T15 evidence

- bounded-executor/prepare_admission.py: the live admission from the pilot example, pins read
  from the image's commit, window <= 2 h (audit-core's declared bound), validated.
- executor-lanes.py window-open/window-close: CCR-2026-0058's window-scoped write role, created
  for one admitted open window under attended platform-admin and deleted afterwards (idempotent).
- security-cases/nk-bind-executor-approval.yaml: the case of record, proposed (founder acceptance).
- docs/evidence/2026-11-04-nk56-t15-audit-sender: 8 checks against audit-core 876c3f6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350

security-cases/nk-bind-executor-approval.yaml

@@ -0,0 +1,25 @@
+# KeyCape service client for the bounded executor's approval calls (NK-WP-0056-T06 prerequisite).
+# The case of record; identical parameters to the type's first example. Status proposed until the founder
+# accepts it (type acceptance: owner and founder). Going live makes oidc-service-client 0.2 `implemented`.
+apiVersion: netkingdom.io/security-case/v0.1
+kind: SecurityCase
+spec:
+  id: nk-bind-executor-approval
+  type: oidc-service-client@0.2
+  status: proposed
+  owner:
+    repo: net-kingdom
+    person: founder
+  parameters:
+    client_id: nk-bind-executor-approval
+    display_name: NetKingdom bounded executor (approval-engine)
+    audience: approval-engine
+    allowed_scopes: approval:create,approval:read,approval:consume
+    service_subject: service:nk-bind-executor
+    tenant: tenant:platform
+    roles: bounded-executor
+    token_lifetime: 15m
+    consuming_service: bounded-executor
+    consumer_namespace: sso
+    consumer_service_account: nk-bind-executor
+    consumer_owner_repo: rapp-bounded-executor