Proves that the key-protection backend a tier declared actually answers with the configuration it carries, and records that it does. An ephemeral, non-tenant key is wrapped and unwrapped against the tier's own backend; only when that round trip completes does the tier advance from DECLARED_PENDING_BIND through BINDING to ACTIVE and record when it bound. Nothing about a tenant is touched: the probe key carries a distinct marker, is never persisted, and can never become tenant key material. A tier that has declared no backend type is refused 409 — select a type first. A tier that is already ACTIVE is an idempotent no-op returning its current view. A tier that is already transitioning is refused 409. If the round trip does not complete the tier is refused 422, is NOT bound, and is left in DECLARED_PENDING_BIND so that correcting the configuration and binding again is the next action. This request carries no credential and no PIN. Required scope: admin.platform.key-backend.tier.manage.