Execute one approved, server-bound Hex operation proposal

Executes canonical identity-only proposals through an atomic server claim. During the bounded compatibility window, legacy self-contained cards are accepted only when explicitly enabled.