Implementation readiness

Governed execution remains deny-by-default until production boundaries are explicit.

SCRIMED now exposes locked workflow execution endpoints that reject requests before body parsing, connector access, workflow mutation, or patient-facing action.