Replace test recipient pins with context-bound send authorization

A single-recipient test pin should not be replaced by an unrestricted provider allowlist when an automation moves to real recipients. Carry a purpose-scoped authorization into the provider boundary and revalidate that the normalized destination still belongs to the active, locked case immediately before dispatch. Keep generic manual and unrelated staging sends on their existing deny-by-default path. This preserves a final destination check without requiring operators to enumerate every legitimate recipient in environment configuration. It does not authorize cold outreach or user-entered arbitrary numbers; those need a separate durable initiation and consent contract.

Applies when: promoting a bounded messaging canary to case-derived recipients. Keywords: SMS recipient allowlist provider boundary case authorization Quo webhook staging