Function resolve_binding_optional 

pub fn resolve_binding_optional(
    graph: &ExternalRuntimeGraph,
    binding: &SecretBinding,
    action_id: &str,
) -> Result<Option<Zeroizing<Vec<u8>>>, NxdError>

Resolve a binding for ensure/create planning.

Returns Ok(None) only for explicit NotFound (binding absence). Permission, decryption, transport, timeout, cancellation, and protocol failures return Err and must not authorize mint/overwrite (prompt 03.1 / D.2).