Bind credential exec to exact owner inputs and approval digest

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

src/secrets_engine/catalog.py

@@ -360,6 +360,16 @@ def validate_entry(data: dict[str, Any], *, source: str = "<memory>") -> Catalog
                     f"{source}: high-risk lanes require {lifecycle_name}.owner"
                 )
 
+    delivery_config = data.get("delivery_config", {})
+    if not isinstance(delivery_config, dict):
+        raise CatalogError(f"{source}: delivery_config must be a mapping")
+    if "exec_owner" in delivery_config:
+        from secrets_engine.exec_owner import validate_exec_owner
+
+        validate_exec_owner(delivery_config["exec_owner"])
+        if "exec-env" not in modes or set(modes) - {"exec-env", "read-check"}:
+            raise CatalogError(f"{source}: exec_owner permits only exec-env and read-check")
+
     # npm-config delivery must declare WHERE it publishes (registry + scope), so
     # the registry is catalog data, never hardcoded in the engine.
     if "npm-config" in modes: