Real build executed for real (MASON-WP-0001-T05, MASON-WP-0001 done 5/5)

Ran the whole approved pipeline against real OpenBao: created the reins/
KV v2 mount (after pausing for explicit founder confirmation -- a bigger
action than the executive summary's blast-radius framing disclosed),
the read-only policy, the AppRole, delivered role_id/secret_id. Caught
and fixed a real bug in the same pass: built with token_num_uses=0
(OpenBao's default = unlimited) instead of the plan's own stated 8;
fixed live and removed the executor's silently-permissive default so it
can't recur. Catalog entry proposed and merged in ops-warden (c0a50bc).

Corrected a real misreading in this repo's own INTENT.md along the way:
pointer fields (auth_method/fetch_command/rotation.steps) are normal on
non-SSH catalog entries; only a bare top-level steps:+cert_command:
pair is SSH-only -- verified against ops-warden's real entries and its
full test suite (326 tests, green).

Plan status: built. Catalog entry status: draft until the founder's
paste-once-provision and glas-harness/GLAS-WP-0002-T02's live
verification succeed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_executor.py

@@ -26,11 +26,19 @@ def _spec(tmp_path) -> AppRoleKVSpec:
         policy_name="workload-kv-read-test-lane",
         kv_path="reins/test/openrouter",
         approle_name="test-lane",
+        token_num_uses=8,
         delivery_dir=tmp_path / "delivery",
         audit_log_path=tmp_path / "audit.jsonl",
     )
 
 
+def test_token_num_uses_has_no_silently_unbounded_default() -> None:
+    import inspect
+
+    sig = inspect.signature(AppRoleKVSpec)
+    assert sig.parameters["token_num_uses"].default is inspect.Parameter.empty
+
+
 def test_refuses_when_not_approved(tmp_path) -> None:
     plan = _plan(tmp_path, status="draft", approved_by=None, approved_at=None)
     with pytest.raises(BuildRefused, match="not approved"):