Replace test recipient pins with context-bound send authorization
A single-recipient test pin should not be replaced by an unrestricted provider allowlist when an automation moves to real recipients. Carry a purpose-scoped authorization into the provider boundary and revalidate that the normalized destination still belongs to the active, locked…