fix: scope executor secure-session lock

Author: Mateusz

internal/core/runtime/executor.go

@@ -34,9 +34,6 @@ var _ lipsdk.ExecutorView = (*Executor)(nil)
 // internal/core/runtime test binary links export_test.go, which assigns this hook in init.
 var secureSessionTestPrepare = func(*Executor) {}
 
-// secureSessionMu guards lazy initialization of Executor.SecureSession in tests.
-var secureSessionMu sync.Mutex
-
 // Executor orchestrates hooks, capability negotiation, routing, B2BUA, and backend attempts.
 type Executor struct {
 	Store b2bua.Store
@@ -80,6 +77,8 @@ type Executor struct {
 	ExtensionMetrics extensions.StageMetrics
 	// CompletionBufferLimits overrides completion-gate buffering bounds (tests). Zero MaxEvents uses SDK defaults.
 	CompletionBufferLimits completion.BufferLimits
+	// secureSessionMu guards lazy initialization of SecureSession in the test hook path.
+	secureSessionMu sync.Mutex
 
 	// SecureSession authorizes turns via BeginTurn before submit hooks; required for all executor prepares.
 	SecureSession *app.Manager
@@ -149,11 +148,11 @@ func (e *Executor) Execute(ctx context.Context, call *lipapi.Call) (_ lipapi.Eve
 	if e.RuntimeSnapshot != nil {
 		ctx = extensions.WithRequestRuntimeSnapshot(ctx, e.RuntimeSnapshot)
 	}
-	secureSessionMu.Lock()
+	e.secureSessionMu.Lock()
+	defer e.secureSessionMu.Unlock()
 	if e.SecureSession == nil {
 		secureSessionTestPrepare(e)
 	}
-	secureSessionMu.Unlock()
 	if e.SecureSession == nil {
 		return nil, fmt.Errorf("executor: secure session manager is required")
 	}