feat: harden orchestrator execution runtime

ops/src/api/admin.ts

@@ -211,6 +211,7 @@ export type OrchestratorConfig = {
   workflowAllowlist: string[];
   fallbackToNative: boolean;
   requireHealthy: boolean;
+  executionEnabled: boolean;
 };
 
 export type OrchestratorRuntime = {
@@ -226,6 +227,7 @@ export type OrchestratorRuntime = {
     requested: boolean;
     enabled: boolean;
     reason: string | null;
+    environmentGate: boolean;
   };
 };