Provision Dynamicfab Stage Bindings

Confirm server-owned bindings for one installed DynamicFab version.

The request deliberately contains no workflow UUIDs. Candidate UUIDs come only from the install's persisted configuration, and the exact required workflow keys/nodes come only from the installed published manifest. The workflow must already have the install organization's durable scope. This endpoint never turns a legacy owner-scoped workflow into a tenant workflow because execution history does not carry immutable tenant provenance.