fix: reject credential idempotency headers

src/adapters/http/http-execution-v3.ts

@@ -468,6 +468,16 @@ export function createContractHttpExecutor(
       // A missing credential never downgrades into an anonymous request.
       return finish(unauthenticated("NOT_STARTED", isCommand), "NOT_STARTED");
     }
+    if (
+      Object.keys(patch.headers).some(
+        (name) => name.toLowerCase() === "idempotency-key",
+      )
+    ) {
+      return finish(
+        violation("UNEXPECTED_IDEMPOTENCY_KEY", "REQUEST", "NOT_STARTED"),
+        "NOT_STARTED",
+      );
+    }
 
     const headers: Record<string, string> = {
       Accept: "application/json",