Idempotently reconcile Pro entitlements against actual resources.

Returns a verdict; when provisioning is needed, submits the same background grow-only auto-resize the subscribe webhook triggers and reports started — the response never waits on the resize work. Repeated calls converge without duplicating resize work: an in-process guard dedupes submissions until the queued worker finishes (a retry racing ahead of the worker's first resize marker reports in_progress instead of enqueuing a duplicate org-wide resize).

Responds 503 when the verdict was needs_provisioning but the background submission could not be queued (e.g. during a rolling deploy) — nothing was queued, and the request is safe to retry.