Loads a session as the CALLER (so row-level security is the first gate). For a link caller there is
no identity to load as, so the real port reads as the configured service principal.
Re-reads the session fresh, runs mutate on it, and persists the returned Config (trusted write).
Current time, epoch ms.
Publishes identity.verified to the session. Must not throw.
Sends an email. Must not throw; reports failure in the result.
Records the audit entry. Must not throw.
Every side effect the workflow needs.