Check a pending claim's DNS TXT proof; provision on success (WO-10 §4.4).

UNAUTHENTICATED AND IT MINTS AN ORG, so the shape of this endpoint is "re-run every gate, then believe the DNS":

• the claim is an INTENT, never a pre-approval — by the time a proof clears, days may have passed: the company may have become a real customer (host clash → 409), the address may have been registered (→ 409), the PSL may be unusable (→ 503). Every gate the signup ran, ran here again, minus the spend limits (the DNS proof is the spend gate on this path, and burning a company-host bucket per "did it propagate yet?" click would lock out the very customer mid-verification).
• the proof is single-use: success clears the token, and a promoted claim (domain attached) stops resolving at all.
• an unknown or expired claim is refused with nothing to enumerate — the claim id is an unguessable bearer handle, and the responses to "wrong" and "never existed" are identical.