Allow raw delegated NyxID service calls - #3687

Issue

Closes #3686

Scope

• Add raw delegated mode to nyxid_invoke_operation when operation_id is omitted and method/relative_path are supplied.
• Keep typed mode on live contracts when operation_id is present, and preserve existing document-guided mode compatibility.
• Enforce service-relative paths, single visible service binding, credential selection, and sensitive header rejection before proxy execution.
• Cover raw delegated reads for registration Agent Key and sender-bound credentials, plus unsafe path/header rejection.

Verification

• dotnet test test/Aevatar.GAgents.ChannelRuntime.Tests/Aevatar.GAgents.ChannelRuntime.Tests.csproj --nologo --filter "ChannelNyxIdConnectedServiceInventoryToolSourceTests" passed: 48/48
• bash tools/ci/test_stability_guards.sh passed
• Local NyxID endpoint check not run; this change is covered at the channel tool/invoker boundary with fake NyxID proxy tests.

Notes

• Raw delegated mode still routes through admitted proxy execution; it does not expose NyxID tokens or accept absolute URLs.
• The base branch is feat/2026-09-18_nyxid-recommended-skill-read per implementation request.

Generated with Claude Code.