Verify current agent-key control with a one-use challenge and DPoP; appends an agent-action receipt to the hash chain (actor: the agent, approval method: dpop:<its key thumbprint>) and returns its hash with the /api/proof inclusion URL, plus a short-lived signed proof token naming that receipt when signing is available. If the receipt cannot be appended, nothing is signed.