Add companion lanes to catalog-bound exec owners (SECRETS-WP-0011 T01-T03)

A configured exec owner may receive fields from other consenting kv lanes.
Each lane is gated, consumed and read through its own AppRole; any refusal
starts no child. Companions are part of the owner digest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 226514@bnt-lap001
Assistant-Session: 26ba103d-05fe-45a1-9cd7-9475bf239df6

workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Multi-lane exec-owner delivery"
 domain: infotech
 repo: secrets-engine
-status: ready
+status: active
 flavor: implementation
 owner: claude-code
 topic_slug: netkingdom
@@ -13,6 +13,7 @@ updated: "2026-09-23"
 related_workplans:
   - SECRETS-WP-0009
   - HFACT-WP-0001
+state_hub_workstream_id: "ecb0643d-bad7-5d63-b340-e77ab9579b0a"
 ---
 
 Demand: SECRETS-WP-0009-T03. A configured `exec_owner` child today receives
@@ -45,8 +46,9 @@ Invariants carried over unchanged:
 
 ```task
 id: SECRETS-WP-0011-T01
-status: todo
+status: done
 priority: high
+state_hub_task_id: "820514c9-f54d-530e-a45c-9a04486831c2"
 ```
 
 Extend `exec_owner` with `companions: [{catalog, field, env}]`. Validate at
@@ -60,8 +62,9 @@ exec-time delivery section.
 
 ```task
 id: SECRETS-WP-0011-T02
-status: todo
+status: done
 priority: high
+state_hub_task_id: "33d0fc37-5f23-53a6-9456-f8bd1cc984f9"
 ```
 
 Run the existing approval-claim / CheckRequest / consume chain once per lane,
@@ -74,8 +77,9 @@ session cleanup. Any failure starts no child and reports which lane refused.
 
 ```task
 id: SECRETS-WP-0011-T03
-status: todo
+status: done
 priority: high
+state_hub_task_id: "52a0ff40-81d6-589a-b05f-3e5f55f81a81"
 ```
 
 Unit tests: validation, digest coverage, collision, stage mismatch, partial
@@ -90,6 +94,7 @@ id: SECRETS-WP-0011-T04
 status: wait
 priority: high
 blocking_reason: "Needs activity-core owner assent to source ACTIVITY_CORE_WORKER_TOKEN from OpenBao (ESO) instead of a hand-generated Kubernetes Secret."
+state_hub_task_id: "cf465065-de7a-5d9c-bc80-fee16ffef70d"
 ```
 
 Request activity-core to move the worker token into OpenBao custody, synced to
@@ -98,3 +103,15 @@ catalog a read lane for the metered owner and add it as the Glas lane's
 companion. This coordinates with activity-core's multi-worker request (hub
 message `914853d9`): a dedicated metered worker token would use the same lane
 shape.
+
+## Implementation return — 2026-09-23
+
+T01–T03 done. `exec_owner.companions` and `delivery_config.companion_of` are
+validated at catalog load. `resolve_companions` runs before any gate, and
+`cmd_exec` gates each lane separately (its own evidence, stance, approval and
+consume) before opening the backend. `exec_with_secret` reads each lane through
+its own AppRole, starts no child if any lane fails, re-checks the binding, and
+redacts every value. Suite: 465 passed. Integration on a throwaway OpenBao: 2
+passed (two lanes to one owner; the primary AppRole is denied the companion
+path). Contract: `docs/exec-owner-binding.md` § Companion lanes. T04 waits on
+activity-core (hub message `6e694682`).