Prove possession and activate a pending wrapper

The activation half of wrapper custody: after creating a PENDING wrapper, the client reads the STORED blob back, unwraps those exact bytes locally, compares the FULL derived public key against the published one, and answers the ECDH key-confirmation challenge from the create response — proof = base64url(HMAC-SHA256(X25519(member_scalar, challenge.epk), possession_message)). Only a holder of the member private key can answer; the server stores only a hash of the expected proof and learns no key material. Activation is atomic: a pending KEY activates with its first wrapper, and a first wrapper on a legacy-custody key flips the scheme to wrapped_legacy_scalar_v1 (the migration cutover). Optional replace_wrapper_id revokes the named old wrapper in the SAME transaction — the recovery-code replacement rule (old code stays valid until the new one is verified). Challenges are single-use and expire in 15 minutes; nothing pending ever counts toward reads, scoping, or recovery posture.