Review/optimize checklist, executive-summary format, build executor (T02-T04)

docs/review-optimize-checklist.md: six checks (naming, TTL/scoping,
redundancy, compaction, ease of use, posture), applied for real to the
rein-openweights plan's section 4 -- including a genuinely useful
finding (credentials.py already expects this exact path/delivery shape,
zero code changes needed to consume it).

docs/executive-summary-format.md: six fixed fields, no bao syntax, no
restating earlier sections, explicit approve/reject/revise decision.
Rendered for real into the plan's section 5 -- ready for an actual
decision.

src/ops_mason/{plan,executor,audit}.py: the phase-4 build executor for
credential_type openbao-approle-kv. Refuses to run against anything but
an approved plan -- verified the refusal never even calls subprocess.run.
role_id/secret_id (the AppRole's own access credential, not the
downstream secret) land as 0600 files, never logged; the HCL policy
goes over stdin, never argv; the audit trail is metadata-only. 12 tests,
all mocked at the bao boundary (no live OpenBao access from this
session).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

plans/rein-openweights-openrouter-approle.md

@@ -3,7 +3,7 @@ id: rein-openweights-openrouter-approle
 demand_source: glas-harness/workplans/GLAS-WP-0002-T02
 consumer_repo: rein-openweights
 credential_type: openbao-approle-kv
-status: draft
+status: reviewed
 approved_by: null
 approved_at: null
 created: "2026-07-27"
@@ -97,12 +97,59 @@ as-is for its current interactive-caller consumers.
 - **Compaction opportunity:** none identified — nothing existing becomes
   redundant once this lands; the shared `activity-core` lane keeps its
   own consumers.
-- **Open item carried into phase 3/4:** confirm current build-phase
-  posture (`ops-warden/wiki/WorkloadSecurityPosture.md`) still supports
-  `secret_id_ttl=0` (no expiry, matching `agent-harness-binky-mail`'s
-  choice) rather than a rotation schedule — note this explicitly in the
-  executive summary rather than assuming it silently.
+- **Ease of use for the consumer:** matches directly — `credentials.py`
+  already reads `REIN_OPENWEIGHTS_APPROLE_DIR` (defaults to a
+  `role_id`/`secret_id` file pair) and a KV path override via
+  `REIN_OPENWEIGHTS_OPENROUTER_KV_PATH` (defaulting to exactly
+  `reins/rein-openweights/openrouter`, field `api_key`) — this plan's
+  path #1 and delivery #4 need **zero code changes** in
+  `rein-openweights` to consume; the code was already written expecting
+  this exact shape.
+- **Posture check:** build phase (one founder-operator, pre-revenue) per
+  `ops-warden/wiki/WorkloadSecurityPosture.md` — `agent-harness-binky-mail`
+  used `secret_id_ttl=0` (no expiry) at this same posture; carrying that
+  forward here rather than adding a rotation schedule neither
+  `agent-harness-binky-mail` nor current posture requires. **Explicit
+  assumption, not a silent default** — flagged again in the executive
+  summary below for the approval decision to confirm or override.
 
-<!-- Phase 3 (executive summary) and phase 4 (build result) sections are
-     appended once MASON-WP-0001-T03/T04 land — this file stops at phase 2
-     until then. -->
+## 5. Executive summary (phase 3)
+
+**One-line ask:** create a narrowly-scoped, non-interactive credential
+lane so `rein-openweights` can fetch its own OpenRouter API key at run
+time without an operator present.
+
+**Who/what gets access:** a new OpenBao AppRole named `rein-openweights`.
+Nothing else — no existing role, human, or service gains anything new.
+
+**To what:** read-only access to exactly one KV path,
+`reins/rein-openweights/openrouter` (field `api_key`) — a path that does
+not exist today and holds nothing else. The AppRole cannot read the
+existing shared `activity-core`/`llm-connect` secret or any other path.
+
+**For how long:** each login is a 15-minute token, renewable up to a
+30-minute cap, bounded number of uses per token — matches the existing
+`agent-harness-binky-mail` lane exactly. The AppRole credential itself
+(`role_id`/`secret_id`) does not expire on a schedule at current
+(build-phase) posture, same choice already made for
+`agent-harness-binky-mail`.
+
+**Blast radius if the credential leaks:** whoever holds a valid
+`role_id`/`secret_id` pair can mint a short-lived token that reads one
+OpenRouter API key — nothing else in OpenBao. Actual damage from the
+OpenRouter key itself is real but bounded (API spend on that key, no
+data-store or infra access) and independent of this plan (same exposure
+`openrouter-llm-connect`'s existing consumers already carry).
+
+**Cost to reverse:** delete one AppRole, one policy, one KV path — three
+`bao` commands, no other lane or consumer affected. Fully isolated
+blast/reversal radius by construction (that was the point of declining
+reuse in §2).
+
+**Decision needed:** approve as proposed, reject, or send back to phase 1
+with feedback (e.g. different TTL, different path name, or "actually
+reuse the shared lane instead").
+
+## 6. Build result (phase 4)
+
+<!-- Appended once MASON-WP-0001-T04/T05 execute this plan after approval. -->