NK-WP-0058-T06: image 6e364fd9 (c1df8ec) verified and pinned in the rapp (1db015a); waits for the OpenBao role

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

workplans/NK-WP-0058-bounded-execution-operability.md

@@ -509,7 +509,7 @@ status: wait
 priority: medium
 assignee: claude-code
 blocked_on: message-from:railiance-platform
-blocking_reason: "OpenBao role net-kingdom-bounded-executor-window-watch (CCR) requested in 50c86169; then image re-pin and make deploy-window-watch."
+blocking_reason: "OpenBao role net-kingdom-bounded-executor-window-watch (CCR) requested in 50c86169; then the founder runs make deploy-window-watch."
 depends_on: [NK-WP-0058-T09]
 state_hub_task_id: "6a4c7413-0675-5a06-b471-5f849ce0c721"
 ```
@@ -530,8 +530,11 @@ The open check from 2026-11-05 on the overnight window is T11.
   in the last 10 minutes, it flags (exit 3) or closes (deletes the role, proves it gone). 8 stub tests.
 - rapp `manifests/window-watch.yaml` (`df61bd0`): a CronJob every 10 minutes in flag mode, list Jobs only, no
   Secret, deployed with its own `make deploy-window-watch`.
-- **Open:** railiance-platform's CCR for the OpenBao role (read-only first, `50c86169`), the image built from
-  `c1df8ec` re-pinned in the rapp, then the founder's `make deploy-window-watch`.
+- **Image:** `sha256:6e364fd9…` (tag `main-c1df8ec`). Its executor files were verified byte-identical to
+  `c1df8ec`, and it is pinned in the rapp (`1db015a`). It also carries T03's preflight and named causes, so the next
+  admission uses it.
+- **Open:** railiance-platform's CCR for the OpenBao role (read-only first, `50c86169`), then the founder's
+  `make deploy-window-watch`.
 
 ### Runbook and tooling conventions