Trusted-platform binding action for payer-managed onboarding. The caller is the payer-side Account from X-Wingspan-Account and must also have explicit access to the incoming payeeAccountId (for example, both Accounts are controlled by the same Organization, or the authenticated Person has an Authorization grant to both). ServiceAccount-attributed association requires ServiceAccount bearer enforcement and is not enabled for this route yet. This action sets Payee.payeeAccountId without requiring recipient-side acceptLinkRequest, creates or completes the durable PayerPayeeLinkRequest as Linked, and records the supplied authority evidence for audit. It is intended for same-Org / platform-operated migrations where the platform has already established the worker's consent and identity binding outside Wingspan.
Payee creation never accepts or resolves an Account hint. Association is the audited, idempotent transition that mutates the relationship. Fires PayerPayeeLinkRequest.Linked, then Payee.Activated when activation requirements are met. A different already-linked Account returns 409 ResourceConflict; an inaccessible payeeAccountId returns 403 AccountMismatch.
Do not pass an account binding during payee creation; create-time account hints are intentionally not part of the public V3 REST flow.