[jwalin-shah]

Summary

• Add the durable ExecutionIntent and execution-adapter seams to the canonical Inbox MCP control plane.
• Register execution inspection, start, run-status, cancel, and verify-close on the same MCP surface.
• Preserve fail-closed behavior: missing HomeBase/Portfolio authority returns denial before provider lookup, worktree validation, or Orca invocation.
• Add invariant/oracle mapping and focused regression coverage.

Verification

• uv run pytest -o addopts='' -q tests/test_execution_adapter.py tests/test_execution_intent.py tests/test_event_store.py tests/test_mcp_control_plane.py — 95 passed
• uv run ruff check on touched Python files — passed
• git diff --check — passed
• tool construction smoke — 15 tools, execution tools enumerated
• missing-authority path — DENIED before spawn

Explicit limitation

This PR exposes the gated control-plane seam; it does not claim live Orca execution. The running service is a separate checkout and remains at the prior 7-tool surface until the owner reconciles, lands, and restarts it. HomeBase admission, Portfolio lease, and Bridge verification remain required before any real spawn.