Function jekt_sender_by_token 

pub(crate) fn jekt_sender_by_token(
    store: &Store,
    req: &InjectionRequest,
    claimed: &str,
) -> bool

Identity M4d-4: whether a host-tier jekt is from the agent it claims by its token (audit_source_uid is the request’s Caller). Far-side receivers have no Caller and keep checking the signature, which is still sent.