Destroys the secret this provider authenticates with and returns the provider to
DECLARED. The provider itself SURVIVES: its mechanism, sender identity, template
coverage and chain position are untouched, so a revocation does not alter delivery
topology — which is what makes this usable during an incident rather than only
during a rebuild.

The connectivity verdict is discarded with the credential. Re-sealing is

not re-testing: after a fresh credential is sealed the provider is still DECLARED
and must pass a connectivity test again before enable will accept it.

Idempotent, and never a presence oracle. Destroying a credential that was

never sealed answers exactly as destroying one that was. There is deliberately no
409: a refusal that reported "nothing to destroy" would disclose

whether material is present to a caller who holds the write scope but not the read
scope.

The envelope destruction and the demotion are ONE transaction. There is no state in which the material is gone and a provider bound to it still reads ACTIVE — and that includes the second provider when two mechanisms share one credential, as the two Twilio channels do.