hermes - 💡(How to fix) Fix Safe Executor Registry [1 participants]

What to build

Introduce a small executor registry for L that separates safe read-only executors from approval-gated or write-capable actions. This should make it easier to add new executors without scattering source checks and safety policy through command handling.

Acceptance criteria

• Existing read-only executors are registered through a common interface or mapping.
• The registry records executor id, supported work metadata, read-only status, and whether approval is required.
• /lexecute routes through the registry while preserving existing behavior for gateway, LINE webhook, Cloudflare, service, and Docker status checks.
• Unregistered work still blocks with a clear reason and no unsafe action.

Blocked by

• #24975
• #24977