Prove possession of a pending keystore encryption key

vault-agent-envelopes D2 (consult round 1): a keystore_v1 key is published PENDING and becomes a directory recipient only when its publisher answers the ECDH key-confirmation challenge returned by the publish (activation.{challenge_id, epk}). The proof is HMAC-SHA256 over a fixed JCS message keyed by the X25519 shared secret with the server's ephemeral key — computable only by a holder of the private half; the server stored sha256(expected) and learns no key material. Wrong or expired proof never activates (403 POSSESSION_PROOF_INVALID / 410 ACTIVATION_EXPIRED — republish for a fresh challenge). On success the key is synced into every org's desired-recipient state and any key-holder's next vault operation wraps each vault to it. Self-only; same credential gate as publish. The SDK does this in the same invocation as the publish.