Create an execution and hold its single-use permit (permit wire profile)

agent-safe.executors.native/1 §5, step 1. A native platform states one action in its own words (a Business Central payment line or sales document); the executor host resolves the connection from the caller's key, prepares the action, asks Decionis to decide it and bind a single-use grant to its exact intent, and holds the grant unclaimed. HELD returns the permit (permit_id, intent_sha256, expires_at); every other decision returns BLOCKED with its reason codes and no permit. A payment permit is bound to one payment line: company, journal template and batch, line number, the line's own id, vendor, beneficiary-account hash, amount and currency. Posting the legacy payment or sales body here is answered exactly as at its deprecated alias.