Implement exec-file delivery

Write the selected field to a mode-0600 temp file, inject FIELD_FILE for
the child only, then overwrite and unlink on every exit path. The value
is not copied into the child environment.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

SCOPE.md

@@ -202,10 +202,9 @@ secrets-engine audit <catalog-id> [--json]
 secrets-engine evidence heartbeat|drain|classify
 ```
 
-The implemented exec adapters are `exec-env` and `npm-config`. `read-check` is
-verification, `approle-login` is auth-capability handoff metadata, and
-`exec-file` remains a reserved schema name without an exec adapter.
-`secrets-engine wrap` implements response-wrapped operator handoff.
+The implemented exec adapters are `exec-env`, `npm-config`, and `exec-file`.
+`read-check` is verification and `approle-login` is auth-capability handoff
+metadata. `secrets-engine wrap` implements response-wrapped operator handoff.
 
 ## Proven Operationally
 
@@ -222,9 +221,8 @@ verification, `approle-login` is auth-capability handoff metadata, and
 ## Not Implemented
 
 - A service API, daemon, UI, queue, scheduler, or remote multi-user service.
-- OpenBao JWT login and platform materialization for the implemented KeyCape
-  service-auth provider.
-- Native `exec-file` delivery.
+- Platform JWT mount/role materialization for the implemented KeyCape
+  service-auth / `service-jwt` provider.
 - Provider-side rotation or coordinated multi-consumer rollout.
 - First-class rotate, compromise, reactivate, lease-status, or audit report
   commands; lifecycle operations currently execute plans without persistent