Wait within decision validity bounds and preserve failed preflight evidence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

src/secrets_engine/approval_consume.py

@@ -25,6 +25,7 @@ from secrets_engine.decision_check import check_decision
 from secrets_engine.authorization import (
     build_action_request,
     validate_decision_envelope,
+    wait_for_decision_start,
 )
 from secrets_engine.errors import DecisionError
 from secrets_engine.openbao import read_strict_token_file
@@ -312,6 +313,7 @@ def authorize_action(
         request=expected_request,
         opener=pdp_opener or urlopen,
     )
+    wait_for_decision_start(envelope)
     validated = validate_decision_envelope(
         envelope,
         expected_request,