Boot-time provider-authorization claim.

Once the mesh pool is connected, this worker asks the realm — over the mesh, by this service's own wire-authenticated identity — for the D25 delegation its org-namespaced procedures need: io.macula/_realm/_realm/identity/request_provider_authorization_v1.

The realm verifies the caller (the connection proves it), checks membership + org binding, and either issues immediately or records the request as a pending row for its operator. EITHER reply ends this worker's retries — the realm has the claim on file — and the advertise path (mcl_om_capabilities:resolved_authorization/3) resolves the delegation independently once it exists.

No credentials travel: there is nothing to configure here beyond the optional informational labels (service_name, box, app env) the realm's operator sees on the pending row.

See PLAN_PROVIDER_AUTHORIZATION_FLOW.md §3.2 (macula-realm). -------------------------------------------------------------------