Bind credential exec to exact owner inputs and approval digest

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

catalog/glas-claude-agent-dev-anthropic.yaml

@@ -17,6 +17,14 @@ consumers:
   purpose: Owner-admitted glas-harness agt run through the reviewed local profile;
     no caller-facing key fetch
 workload_delivery: []
+delivery_config:
+  exec_owner:
+    status: pending
+    owner: rein-aharness MessagesOwner with sand-boxer runtime boundary
+    reason: Exact installed metered-once runtime is proved; native holder review,
+      immutable owner configuration and private state/profile/service admission
+      remain SECRETS-WP-0009-T03 and HFACT-WP-0001-T03/T04. No arbitrary child may
+      receive this key while the owner binding is pending.
 delivery_modes:
 - exec-env
 - read-check