Run owner-safe hosted provisioning for an Agent OS deployment

Runs hosted provisioning through the selected provider adapter when billing, approval, runtime-lane, and provider bridge gates allow it. Requires one idempotency key in a header or body; multiple aliases must match. Provider configuration is derived only from the reviewed deployment and operator approval, so material provider overrides on this route are rejected. Under a deployment lock, a caller-key-independent provider-effect ledger freezes an immutable dispatch projection containing the authorized request, provider revision, provider service reference, secret references, provider-state inputs, and adapter configuration. Only that locked projection reaches the provider. Dispatch relocks and rechecks the owner version plus stored configuration and projection hashes. Any in-progress or indeterminate effect blocks every different effect for the deployment; uncertain post-dispatch outcomes require reconciliation and are never retried automatically. Native platform-hosted runtimes additionally require a platform-selected immutable digest-pinned image in the allowlist, a deployment-scoped credential and task role, and a signed-request callback origin. Callers cannot override the image, role, callback, start command, port, or credential metadata. Existing native runtimes use a fail-closed staged cutover: pause the prior service, create an isolated candidate, persist pending state without replacing active URL/auth metadata, verify health plus missing/valid auth on /capabilities and /invoke, then promote. Failed candidates are paused and require a CAS-protected retry with a different reviewed digest/new credential version or explicit abandon. Completed requests return a full reviewed result; long-running hosted work can return an accepted pending response with poll links.