Donor confirms a proxy claim in waiting_resolution. On provider
success the claim moves to pending_confirmation; on provider failure
it moves to confirmation_rejected. Both outcomes return 200 —
rejections are stored business states, not HTTP errors.

pending_confirmation is finalised asynchronously by the
proxy_claim.confirmation_completed event, which transitions the claim
to confirmed and — if it has a bound proxy_key_id — releases the
linked proxy key (status = disabled,
status_reason = released_via_claim) in the same transaction.