Review/optimize checklist, executive-summary format, build executor (T02-T04)

docs/review-optimize-checklist.md: six checks (naming, TTL/scoping,
redundancy, compaction, ease of use, posture), applied for real to the
rein-openweights plan's section 4 -- including a genuinely useful
finding (credentials.py already expects this exact path/delivery shape,
zero code changes needed to consume it).

docs/executive-summary-format.md: six fixed fields, no bao syntax, no
restating earlier sections, explicit approve/reject/revise decision.
Rendered for real into the plan's section 5 -- ready for an actual
decision.

src/ops_mason/{plan,executor,audit}.py: the phase-4 build executor for
credential_type openbao-approle-kv. Refuses to run against anything but
an approved plan -- verified the refusal never even calls subprocess.run.
role_id/secret_id (the AppRole's own access credential, not the
downstream secret) land as 0600 files, never logged; the HCL policy
goes over stdin, never argv; the audit trail is metadata-only. 12 tests,
all mocked at the bao boundary (no live OpenBao access from this
session).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/ops_mason/plan.py

@@ -0,0 +1,56 @@
+"""Parse a construction plan file's YAML frontmatter.
+
+See docs/construction-plan-format.md. The frontmatter's status field is
+the phase-4 hard gate: the build executor (executor.py) refuses to run
+against anything but status: approved with both approved_by/approved_at
+set.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+
+class PlanError(RuntimeError):
+    pass
+
+
+@dataclass
+class ConstructionPlan:
+    id: str
+    status: str
+    approved_by: str | None
+    approved_at: str | None
+    demand_source: str
+    consumer_repo: str
+    credential_type: str
+    path: Path
+
+    @classmethod
+    def load(cls, path: str | Path) -> ConstructionPlan:
+        path = Path(path)
+        text = path.read_text()
+        parts = text.split("---", 2)
+        if len(parts) < 3 or not text.startswith("---"):
+            raise PlanError(f"{path}: missing YAML frontmatter")
+        data: dict[str, Any] = yaml.safe_load(parts[1]) or {}
+        missing = {"id", "status"} - set(data)
+        if missing:
+            raise PlanError(f"{path}: frontmatter missing field(s): {', '.join(sorted(missing))}")
+        return cls(
+            id=data["id"],
+            status=data["status"],
+            approved_by=data.get("approved_by"),
+            approved_at=data.get("approved_at"),
+            demand_source=data.get("demand_source", ""),
+            consumer_repo=data.get("consumer_repo", ""),
+            credential_type=data.get("credential_type", ""),
+            path=path,
+        )
+
+    def is_approved(self) -> bool:
+        return self.status == "approved" and bool(self.approved_by) and bool(self.approved_at)