Bind credential exec to exact owner inputs and approval digest

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

src/secrets_engine/authorization.py

@@ -105,6 +105,12 @@ def build_action_request(
             "context": {"purpose": purpose},
         }
     )
+    if action == "exec":
+        from secrets_engine.exec_owner import owner_digest
+
+        digest = owner_digest(entry)
+        if digest is not None:
+            request["context"]["exec_owner_sha256"] = digest
     return request