Why a WrappedStoreKey could not be authenticated and unwrapped. Named
per reason so the caller can surface why an adoption was refused — a
substituted/forged key (the signature does not verify against the pinned
owner) is distinct from a corrupt object (the sealed box is not valid hex) —
rather than collapsing both into one opaque failure.
The signature does not verify against an authorized Owner over
(store_id, recipient_pubkey, author_pubkey, sealed). Covers a box
signed by anyone outside the authorized set, a payload tampered after
signing (different store, slot, author, or sealed bytes), and a
malformed signature or owner pubkey — all indistinguishable here and all
meaning “not authentically signed by an authorized Owner”.