NK-WP-0056: founder decisions folded in; runtime split into T11 and T12

Window-scoped write role (CCR-2026-0058 approved as amended), bind
self-rotation (pilot step is OPERATE on the one bind; svc-executor-pw
dropped), pilot without the PDP gate (not-evaluated), started event plus one
receipt per run, rapp Job in sso, owner workplans approved. New tasks: T11
core runner, T12 pilot operations and packaging; T06 depends on T12.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

tools/bounded-execution-admission/tests/test_validate.py

@@ -95,7 +95,10 @@ class RuleTests(unittest.TestCase):
             {"mode": "GOVERN", "scope": "lldap", "environments": ["PRODUCTION"]}))))
         # whole-directory ADMINISTER for a delegable step at medium risk
         def widen(s):
-            s["scope_ceiling"][1]["scope"] = "lldap"
+            s["scope_ceiling"][1].update(mode="ADMINISTER", scope="lldap")
+            for step in s["plan"]["steps"] + s["plan"]["revert_steps"]:
+                if step["requires"]["scope"].startswith("lldap/"):
+                    step["requires"]["mode"] = "ADMINISTER"
         self.assertIn("BEA-5", rules(mutate(ROTATION, widen)))
 
     def test_bea6_least_privilege(self):