Function verify_reagent_jekt 

pub fn verify_reagent_jekt(
    key_id: &str,
    msgid: &str,
    source_agent: &str,
    target_agent: &str,
    ts_secs: i64,
    message: &str,
    sig_b64: &str,
) -> bool

Verify a WAN-tier jekt’s claimed reagent_sig against the pinned public key for key_id. Returns false (never panics) for an unknown key_id, malformed base64, a malformed/wrong-length signature, or a signature that simply doesn’t verify — callers should treat all of these identically: “not verified,” rendering SIG=invalid rather than SIG=verified in the marker (see wrap_jekt_message’s doc comment).

This function alone does NOT make a verified sender: a message signed under reagent-v1-dev verifies here exactly like one under the production key. Receivers must use verify_trusted_reagent_jekt.