[JAORMX]

Scope

Follow-up to merged #1984 (fix/native-execution-private-registry), now targeting main. This PR changes only the draft execution chart and its existing operator guide:

• Opt-in provider.securitySources maps explicit keys from up to eight pre-existing Secrets to unique basenames in the provider's projected security directory (32 mappings total). Reject missing manifest file mappings, duplicate sources/keys/destinations, unsafe paths, and collision with ConfigMap-owned manifest.json without reading or rendering Secret contents.
• Keep provider.securitySecretName as the mutually exclusive, unchanged single-Secret path; it still projects all keys so operators can stage rotation material.
• Keep mapping changes possible while allocations survive: populate new Secret keys, quiesce and add mappings with the old manifest, then publish a higher-generation manifest naming the new immutable files. The existing runtime authority high-water ledger and per-RPC peer checks remain unchanged. Switching legacy/multi-source mode with retained allocations is still rejected by the existing lifetime identity.
• Test actual Helm render/lookup paths for both modes, invalid mappings, redacted failures, and retained allocation staging; update the existing operator guide in place. No new Secret or provider RBAC resource is created.

This is a narrow follow-up to private image pulls, not a general Pod configuration or authority redesign. No Kubernetes cluster or real Secret was accessed.

Verification

• go test ./deploy/helm/mecatl-execution ./internal/adapter/executioncontroller -count=1 — pass.
• go test ./deploy/helm/mecatl-execution -race -count=1 — pass.
• task lint, Helm lint, task site:build, and synthetic multi-Secret helm template | kubeconform -strict (17 valid resources) — pass.
• task docs — pass on the conflict-resolved integration commit 2a2099794 in a clean worktree (the primary checkout contains unrelated untracked docs).
• task test and task test:race — not green in clean throwaway checkouts: unrelated TestMicroVMEnvironments_Scenario3_SourceStateCaptureIsExactOrFails fails when Git cannot launch an empty external diff command (cannot run : No such file or directory). No race was reported; CI must independently verify the stacked commit.

No live-cluster projection/rotation qualification, published-artifact verification, or human security approval is claimed. The conflict with main is resolved in merge commit 2a2099794; the PR diff remains six scoped files. Humans alone merge.