Controlled Private Execution + Owner Run Gate

Authorize and run local execution proofs for queued private work. This is the first run-control layer: it confirms workflow control and manifest assembly without calling an external provider or creating media. External generation is connected in the provider activation phase.