Reject signed non-authorizing receipt statuses

[manuelsampedro1]

Summary

• reject signed receipts whose status is not one of the v1 authorization lifecycle states
• keep revoked classified as expired/revoked, but fail closed for unknown/non-authorizing statuses
• add a regression test that re-signs a receipt with status: DENIED and verifies it is rejected despite a valid Ed25519 signature

Why

The local verifier currently treats every signed, unexpired status except lowercase revoked as authorization-valid. That means any signed receipt carrying a non-authorizing or legacy status such as DENIED, PENDING, or EXPIRED can be accepted by downstream consumers that rely on pp verify/verifyReceipt exit code as the authorization decision. The test demonstrates the issue using a freshly valid Ed25519 signature over status: DENIED.

Related to permission-protocol/deploy-gate#36 because this is a flaw in the signing/verification acceptance flow rather than a raw signature forgery.

Validation

• npm ci
• npm test -- --run
• npm run build
• git diff --check