Atomically claim one provider-bound execution permit

Authenticated credential-isolated executor primitive. Requires a paid live PROCESSOR bearer credential whose exact processor_audience equals the permit aud claim and a RUNNING account-wide execution interlock in the same atomic transaction. The compact permit and exact provider, payee, amount and resource request are revalidated against the stored issuance record. Exactly one fresh atomic ISSUED-to-CLAIMED transition returns provider_submission_permitted=true. This proves only a single winner in MandateShield state; it neither calls the provider nor guarantees exactly-once provider delivery. A customer-deployed exclusive executor may then attempt the exact provider request with the signed provider idempotency key. An exact idempotent replay reports the same claim with provider_submission_permitted=false; another claim conflicts. Supply Idempotency-Key in the header or idempotency_key in the body. If both are present they must be byte-identical. A caller must fail closed on timeout or ambiguity. This contract does not claim PSP/provider adoption or provider enforcement.