Signed ticket verification fails

Symptom

signed_ticket_verifier.verify returns signature_invalid or principal_unknown.

Resolution

1. Confirm the private key is the one matching the public key in agent-harness/governance/allowed_signers.
2. Confirm the namespace matches the ticket's namespace.
3. Confirm the payload file has not been edited since signing.
4. Confirm the principal name matches the issuer field.
5. Re-sign if necessary.