Verify a stream ticket, returning its claims or undefined (fail closed).
The signature is recomputed over the presented payload segment and compared
CONSTANT-TIME; then every claim is validated: exp unexpired, tenantId
pattern-valid and not reserved, channel known, runId present if and only if the run
channel (and when present PATH_SAFE and tenant-owned), actorId non-empty,
and role a recognized APPROVAL_ROLE. Any failure returns undefined.
Verify a stream ticket, returning its claims or
undefined(fail closed). The signature is recomputed over the presented payload segment and compared CONSTANT-TIME; then every claim is validated:expunexpired,tenantIdpattern-valid and not reserved,channelknown,runIdpresent if and only if the run channel (and when present PATH_SAFE and tenant-owned),actorIdnon-empty, androlea recognized APPROVAL_ROLE. Any failure returnsundefined.