Donor confirms a proxy claim in waiting_resolution, transitioning it to confirmed (on provider success) or confirmation_rejected (on provider failure). Both outcomes return 200 — rejections are stored business states, not HTTP errors.

On success, if the claim has a bound proxy_key_id, the linked proxy key is transitioned from active to disabled with status_reason = released_via_claim in the same transaction.