Allow raw delegated NyxID service calls

[louis4li]

Issue

Closes #3686

Scope

• Add raw delegated mode to nyxid_invoke_operation when operation_id is omitted and method/relative_path are supplied.
• Keep typed mode on live contracts when operation_id is present, and preserve existing document-guided mode compatibility.
• Enforce service-relative paths, single visible service binding, credential selection, and sensitive header rejection before proxy execution.
• Cover raw delegated reads for registration Agent Key and sender-bound credentials, plus unsafe path/header rejection.

Verification

• dotnet test test/Aevatar.GAgents.ChannelRuntime.Tests/Aevatar.GAgents.ChannelRuntime.Tests.csproj --nologo --filter "ChannelNyxIdConnectedServiceInventoryToolSourceTests" passed: 48/48
• bash tools/ci/test_stability_guards.sh passed
• Local NyxID endpoint check not run; this change is covered at the channel tool/invoker boundary with fake NyxID proxy tests.

Notes

• Raw delegated mode still routes through admitted proxy execution; it does not expose NyxID tokens or accept absolute URLs.
• The base branch is feat/2026-09-18_nyxid-recommended-skill-read per implementation request.

Generated with Claude Code.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.