Run a registered operation using a stored credential

Makes an authenticated outbound call using a credential this Mac holds, without the caller ever receiving the material.

The body carries three ids and nothing else. The destination, method, path, query and headers all come from the registered operation, so there is no url, method, headers, body, auth, allow_local, redirect or output-path field — unknown keys are refused rather than ignored, including when null or false.

The response is a bounded projection: the operation id and known model ids drawn from bundled constants. No upstream headers, body, final URL or status text is relayed. An upstream 401 returns upstream_rejected (502), which is NOT credential_required and deletes, refreshes and retries nothing.