NK-WP-0056-T11 done: bounded executor core runner

Consumes one admission once through the approval-engine carrier after an
effect-free preflight (validity, source pins, trust, window vs budget,
binding digest, actor, human aal2 approvers), emits run.started, runs steps
with settle-timed checks, reverts on failure with per-revert checks, retries
within attempts, stops on unknown outcomes, honours budget and kill switch,
and emits one value-free receipt (PDP not-evaluated). 22 tests with fakes.
BEA-9 extended to revert steps; examples regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml

@@ -49,7 +49,7 @@ spec:
   plan:
     source:
       repo: net-kingdom
-      commit: c9ab01e23e92
+      commit: 3b1abc405423
       files:
       - path: tools/service-binds/bind-lane.py
         sha256: 5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0
@@ -114,6 +114,8 @@ spec:
       requires:
         mode: OPERATE
         scope: openbao/platform/workloads/net-kingdom/directory-binds/svc-authelia
+      checks_after:
+      - kv-advanced
     - id: restore-directory
       operation: lldap.user.change-own-password-from-kv
       target: lldap:svc-authelia
@@ -123,6 +125,8 @@ spec:
       requires:
         mode: OPERATE
         scope: lldap/people/svc-authelia
+      checks_after:
+      - bind-signs-in
     - id: redeliver
       operation: eso.force-sync
       target: k8s:sso/externalsecret/authelia-secrets
@@ -132,6 +136,8 @@ spec:
       requires:
         mode: OPERATE
         scope: k8s/sso/externalsecret/authelia-secrets
+      checks_after:
+      - eso-synced
     - id: restart-again
       operation: k8s.rollout-restart
       target: k8s:sso/deployment/authelia
@@ -141,7 +147,9 @@ spec:
       requires:
         mode: OPERATE
         scope: k8s/sso/deployment/authelia
-  plan_digest: sha256:36328096076c71ade582173092511be6aee546281ef5edb3c2acaadaf7c9e1fb
+      checks_after:
+      - synthetic-journey
+  plan_digest: sha256:ce9253adf5084dc1b40c1004258d9f8480b236d8ed26fabbb2a983c853a4dc21
   checks:
   - id: kv-advanced
     description: KV svc-authelia has exactly one new version, CAS on the previous one

examples/bounded-execution-admission/bind-split-create-service-accounts.yaml

@@ -43,7 +43,7 @@ spec:
   plan:
     source:
       repo: net-kingdom
-      commit: c9ab01e23e92
+      commit: 3b1abc405423
       files:
       - path: sso-mfa/k8s/lldap/bind-split.py
         sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
@@ -84,6 +84,8 @@ spec:
       requires:
         mode: ADMINISTER
         scope: lldap
+      checks_after:
+      - accounts-read-only
     - id: destroy-kv
       operation: openbao.kv.destroy-created
       target: openbao:platform/workloads/net-kingdom/directory-binds
@@ -93,7 +95,9 @@ spec:
       requires:
         mode: OPERATE
         scope: openbao/platform/workloads/net-kingdom/directory-binds
-  plan_digest: sha256:139e7b874d8d8ba9419f141bf9e10341a9a0057bb75fa47eee32c2ee19b396ce
+      checks_after:
+      - accounts-sign-in
+  plan_digest: sha256:a4c60ad06ae93b7ebc4d12417678a7bf8e7507f6670d8861cb5b30c2cd517b68
   checks:
   - id: accounts-read-only
     description: each account exists in lldap_strict_readonly only and cannot write

examples/bounded-execution-admission/bind-split-read-only-verify.yaml

@@ -46,7 +46,7 @@ spec:
   plan:
     source:
       repo: net-kingdom
-      commit: c9ab01e23e92
+      commit: 3b1abc405423
       files:
       - path: sso-mfa/k8s/lldap/bind-split.py
         sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
@@ -73,7 +73,7 @@ spec:
         scope: k8s/sso
       checks_after:
       - split-shape
-  plan_digest: sha256:0459999b93bb8aee0dacb1b36ea95d114ac74d0ed775095f3ee5dc2ee66203cd
+  plan_digest: sha256:8c2195390ce140d2600667f2787c9fa2685a62ff918fb298d17e3b3aa3762bc5
   checks:
   - id: split-shape
     description: every consumer binds as its own svc- account; no service binds as admin

examples/bounded-execution-admission/bind-split-switch-super-admin.yaml

@@ -43,7 +43,7 @@ spec:
   plan:
     source:
       repo: net-kingdom
-      commit: c9ab01e23e92
+      commit: 3b1abc405423
       files:
       - path: sso-mfa/k8s/lldap/bind-split.py
         sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
@@ -84,6 +84,8 @@ spec:
       requires:
         mode: ADMINISTER
         scope: lldap
+      checks_after:
+      - ld-admin-administers
     - id: restart-lldap-again
       operation: k8s.rollout-restart
       target: k8s:sso/deployment/lldap
@@ -93,7 +95,9 @@ spec:
       requires:
         mode: OPERATE
         scope: k8s/sso/deployment/lldap
-  plan_digest: sha256:5f51601ce96a07da5fa56b5b00c2066c572e3b19a4677b1a16cee3178295cae0
+      checks_after:
+      - synthetic-journey
+  plan_digest: sha256:78e9b24a77955c0b7372d6733e8a6b4da17656eb5a9100a416c4d73eef981d6f
   checks:
   - id: ld-admin-administers
     description: ld-admin signs in and administers; admin keeps lldap_admin membership