Mint a single-use claim-intent ticket (anonymous, birth-token proof).

The true-first-timer claim flow (MNE-879). A LOGGED-OUT user who opens a dojo claim link proves ownership with the birth token (mnbt_…) / hash proof and receives a short-lived, single-use, opaque ticket (mci_…). That ticket — NOT the secret proof — rides the sign-up → email-confirm → return round-trip, so nothing sensitive lands in the URL, the confirmation email, or browser localStorage (which is gone when the email opens on another device — the exact reason a first-timer claimed an agent but it never bound to its dojo config). The proof is verified HERE and never stored; the ticket is the post-verification capability. Intentionally public (security: []) — the birth-token proof IS the authorization, the same posture as /dojo/try-me/resolve. Exchange the ticket via POST /dojo/claim-intent/exchange once authenticated.