Destroys the secret this provider authenticates with and returns the provider to
DECLARED. The material removed is the PATH tenant's, sealed under that tenant's own
KEK — never the caller's. The provider itself SURVIVES: its mechanism, sender
identity, template coverage and chain position are untouched, so a revocation does
not alter delivery topology.

The connectivity verdict is discarded with the credential. Re-sealing is

not re-testing: after a fresh credential is sealed the provider is still DECLARED
and must pass a connectivity test again before enable will accept it.

Idempotent, and never a presence oracle. Destroying a credential that was

never sealed answers exactly as destroying one that was. There is deliberately no
409: a refusal that reported "nothing to destroy" would disclose

whether material is present to a caller who holds the write scope but not the read
scope.

The envelope destruction and the demotion are ONE transaction. There is no state in which the material is gone and a provider bound to it still reads ACTIVE — and that includes the second provider when two mechanisms share one credential, as the two Twilio channels do.