Function reagent_sig_is_fresh 

fn reagent_sig_is_fresh(ts_secs: i64, now: i64) -> bool

Is ts_secs (a reagent signature’s claimed signing time) within REAGENT_SIG_MAX_AGE_SECS of now? Extracted as a pure function (takes now explicitly rather than calling now_unix_secs() itself) so it’s unit-testable without mocking the system clock. ts_secs <= 0 is never fresh — a zero/negative timestamp only happens for a malformed or missing claim, never a genuine signature.