Bind credential exec to exact owner inputs and approval digest

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

src/secrets_engine/cli.py

@@ -542,9 +542,12 @@ def cmd_wrap(cfg: Config, args) -> int:
 
 def cmd_exec(cfg: Config, args) -> int:
     from secrets_engine.exec_delivery import exec_with_secret
+    from secrets_engine.exec_owner import validate_delivery_target
     entry = get_entry(cfg.catalog_dir, args.catalog)
     field = args.field or (entry.fields[0] if entry.fields else "")
     session_detail: dict[str, object] = {}
+    # Refuse a substituted recipient before consuming approval or opening Bao.
+    owner_digest = validate_delivery_target(entry, field, args.command, args.mode)
     command_name = args.command[0] if args.command else ""
     with _privileged_evidence(
         cfg,
@@ -555,6 +558,7 @@ def cmd_exec(cfg: Config, args) -> int:
             "mode": args.mode,
             "field": field,
             "session": session_detail,
+            "exec_owner_sha256": owner_digest,
         },
     ) as evidence:
         # require approval + readiness before running.
@@ -575,6 +579,7 @@ def cmd_exec(cfg: Config, args) -> int:
                 args.command,
                 mode=args.mode,
                 session_evidence=session_detail,
+                expected_owner_digest=owner_digest,
             )
         evidence.finish(f"exit-{rc}")
     return rc