Founder-private executive access

This canonical executive runtime fails closed until the Founder access boundary is authenticated.