Run the managed runtime provisioning bridge

Operator-only live fulfillment path for supported hosted deployments. Requires one matching idempotency key across the documented body and header aliases. Uses the same deployment-wide provider-effect lock, immutable provider projection, and pre-dispatch owner/configuration/projection fences as agent, self-serve, and Start provisioning. Missing or conflicting keys fail before any provider call. An active effect blocks every new effect for the deployment; an indeterminate effect requires explicit reconciliation. Current live scope is limited to eligible managed-runtime requests. Persists the public runtime address and operation state needed for audit and rollback.