Bind typed execution context across authorization requests

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

src/secrets_engine/authorization.py

@@ -18,6 +18,7 @@ from typing import Any
 
 from secrets_engine.catalog import CatalogEntry, human_control_required
 from secrets_engine.errors import DecisionError
+from secrets_engine.execution_contract import ExecutionContract, attach_execution_contract
 from secrets_engine.application_time import validity_bounds
 
 DIGEST_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
@@ -67,6 +68,7 @@ def build_action_request(
     auth_targets: list[str] | tuple[str, ...] = (),
     request_id: str = "",
     tenant: str = REQUEST_TENANT,
+    execution_contract: ExecutionContract | None = None,
 ) -> dict[str, Any]:
     """Build the exact normalized secrets-engine profile for flex-auth.
 
@@ -121,6 +123,7 @@ def build_action_request(
             },
         }
     )
+    attach_execution_contract(request, execution_contract)
     if human_control_required(entry):
         # Bind the requested control to the exact PDP submission. This is a
         # requirement on the observed approval, not an authorization verdict.