current_name_on_certificate is the display/consistency field: re-checked against the row in
UpdateCertificateTool::execute before anything is changed, so a stale or wrong value refuses
rather than mutates.
Corrects the name printed on an already-issued certificate, and optionally the date it was
issued on, after the admin confirms. The certificate image is rendered from the row on every
view, so both corrections take effect on the existing link.
Refuses unless every course the certificate’s configuration requires a module from is
course_id. Authorization is checked against course_id alone, so without this a call could
pair a certificate with an unrelated course the admin happens to teach.