feat: admit existing OpenBao catalog lanes

src/secrets_engine/exec_delivery.py

@@ -52,6 +52,10 @@ def resolve_npm_token_env(entry: CatalogEntry, *, policy_dir=None) -> str:
 
 def _fetch_value(client: OpenBaoClient, entry: CatalogEntry, field: str) -> str:
     """Read the field value via an approle-scoped token. Held in memory only."""
+    if entry.delivery_auth_method != "approle" or not entry.has_delivery_auth:
+        raise DeliveryError(
+            f"lane '{entry.id}' has no AppRole delivery auth for native exec"
+        )
     try:
         token = client.approle_login_token(entry.role_name)
     except Exception as e:
@@ -126,6 +130,10 @@ def exec_with_secret(
     """
     if not command:
         raise DeliveryError("no command given to exec")
+    if field not in entry.fields:
+        raise DeliveryError(
+            f"field '{field}' not declared in lane '{entry.id}' fields {entry.fields}"
+        )
 
     declared = set(entry.delivery_modes)
     if mode == "auto":