Implement exec-file delivery

Write the selected field to a mode-0600 temp file, inject FIELD_FILE for
the child only, then overwrite and unlink on every exit path. The value
is not copied into the child environment.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

tests/test_exec_delivery.py

@@ -63,6 +63,59 @@ def test_exec_env_injects_only_selected_declared_field(monkeypatch):
     )
 
 
+def test_exec_file_injects_path_not_value_and_unlinks(monkeypatch, tmp_path):
+    data = copy.deepcopy(VALID)
+    data["delivery_modes"] = ["exec-file"]
+    entry = validate_entry(data)
+    seen = {}
+
+    def fake_fetch(_client, _entry, field):
+        assert field == "api_token"
+        return "test-secret-value"
+
+    def fake_spawn(command, env, secret):
+        path = env["API_TOKEN_FILE"]
+        seen["path"] = path
+        seen["exists_during"] = __import__("pathlib").Path(path).is_file()
+        seen["mode"] = __import__("pathlib").Path(path).stat().st_mode & 0o777
+        seen["contents"] = __import__("pathlib").Path(path).read_text()
+        seen["has_value_env"] = "API_TOKEN" in env
+        assert command == ["probe"]
+        assert secret == "test-secret-value"
+        return 0
+
+    monkeypatch.setattr("secrets_engine.exec_delivery._fetch_value", fake_fetch)
+    monkeypatch.setattr("secrets_engine.exec_delivery._spawn", fake_spawn)
+    assert exec_with_secret(object(), entry, "api_token", ["probe"], mode="exec-file") == 0
+    assert seen["exists_during"] is True
+    assert seen["mode"] == 0o600
+    assert seen["contents"].strip() == "test-secret-value"
+    assert seen["has_value_env"] is False
+    assert not __import__("pathlib").Path(seen["path"]).exists()
+
+
+def test_exec_file_unlinks_after_child_failure(monkeypatch):
+    data = copy.deepcopy(VALID)
+    data["delivery_modes"] = ["exec-file"]
+    entry = validate_entry(data)
+    seen = {}
+
+    monkeypatch.setattr(
+        "secrets_engine.exec_delivery._fetch_value",
+        lambda *_args, **_kwargs: "test-secret-value",
+    )
+
+    def fake_spawn(command, env, secret):
+        seen["path"] = env["API_TOKEN_FILE"]
+        raise RuntimeError("child exploded")
+
+    monkeypatch.setattr("secrets_engine.exec_delivery._spawn", fake_spawn)
+    with pytest.raises(RuntimeError, match="child exploded"):
+        exec_with_secret(object(), entry, "api_token", ["probe"], mode="exec-file")
+    assert seen["path"]
+    assert not __import__("pathlib").Path(seen["path"]).exists()
+
+
 def test_exec_rejects_undeclared_field_before_fetch(monkeypatch):
     entry = validate_entry(VALID)
     monkeypatch.setattr(