class OpenUI::Rails::Actions::Dispatcher

The single authorization and execution path for every write-ish call, whether it originated from a component ‘onAction` or a browser `toolProvider` `Query()`/`Mutation()`. It fails closed: with no authorizer configured, an action is denied.

Order of checks (all before any side effect):

1. resolve + validate the submission
2. action is registered (allowlist)
3. args match the schema
4. confirmation when the action is destructive
5. surface revision is current (stale protection)
6. authorizer allows it
7. idempotency claim (duplicates never execute twice)