Admit code execution routes from keys auto_connected

[eanz17]

Problem

NyxID GET /api/v1/user-services does not return auto_connected. Only GET /api/v1/keys does. Aevatar read the routing projection, defaulted the missing field to false, treated platform-hosted chrono-sandbox routes as writable, and sent PUT /api/v1/user-services/{id}. Production rejected those updates (403). Personal fallback POST /api/v1/keys omitted the required label (422). Non-2xx bodies were unwrapped as ordinary strings and reported as PostconditionMismatch, which then surfaced as CODE_EXECUTION_ROUTE_REPAIR_UNVERIFIED.

This blocked code_execute admission for operator scopes that already had a healthy platform-hosted route (#3429 / #3290).

Solution

• Parse auto_connected as optional from /keys only.
• Join execution authority by exact UserService id; never infer writability from slug, 403 text, or a missing field.
• CanManageRoute requires Execution.AutoConnected == false.
• Personal fallback create sends label Aevatar Code Execution.
• Preserve HTTP rejection as MutationRejected instead of swallowing it into postcondition mismatch.
• Platform-hosted routes are not PUT; personal create is idempotent on 409.

Second commit refreshes the NyxID conformance pin for NyxIdApiAccessContracts.cs. Channel/query WIP in the working tree is not included.

Impact

• src/Aevatar.AI.ToolProviders.NyxId/NyxIdApiAccessContracts.cs
• src/Aevatar.AI.ToolProviders.NyxId/NyxIdApiClient.cs
• src/Aevatar.AI.ToolProviders.NyxId/NyxIdCodeExecutionRoutePolicyReconciler.cs
• src/Aevatar.AI.ToolProviders.NyxId/NyxIdUserServiceRouteConverger.cs
• test/Aevatar.AI.Tests/NyxIdCodeExecutionRouteAdmissionPreparerTests.cs
• docs/contracts/nyxid-assistant-conformance/v1/sources.json

Verification

dotnet test test/Aevatar.AI.Tests/Aevatar.AI.Tests.csproj --nologo --filter "FullyQualifiedName~NyxIdCodeExecutionRouteAdmissionPreparerTests|FullyQualifiedName~NyxIdAdversarialCorpusTests"
# Passed: 35
bash tools/ci/test_stability_guards.sh
# passed
python3 tools/ci/nyxid_conformance_guard.py --refresh-aevatar-revision HEAD
# pin refreshed from 2c66f55aa

unknown-wire-members in the adversarial corpus already passes on current HEAD and is not part of the admission commit.

Production HR (#3429) and Finance (#3290) submit=false admission, >8 minute Lark identity, and FIN/HR timings remain pending deploy.

[eanzhao]

Superseded: the same admission landed on feature/integrate as 495cc5f50 / f8211188b, with follow-up 53f0cf2cf. This PR's coverage-quality failure was an unrelated testhost crash in RuntimeCallbackSchedulerGrainRecoveryTests, not the AI suite (Aevatar.AI.Tests passed 3412 including unknown-wire-members).

[eanzhao]

Closing as superseded by feature/integrate @495cc5f50.