Authenticates executors with the pre-shared secret and takes node identity from the Hello. Rejects a second live session for a held identity and drops relayed status/logs/results for leases the session does not own, re-authoring status under the lease's workflow id.