Governed Migration Execution Through MCP

Only grant `execution.execute` when machine-started execution is explicitly acceptable to the organization's governance model.