Reject malformed run grant timestamps without changing signed payloads

Description

The pitch.

## Summary

Reject malformed or non-finite timestamps when verifying current Town run grants, without changing signed payloads or adding permission policy.

This preserves the finite-timestamp requirement identified in [#126 by Charanarravindaa](https://github.com/projnanda/nandatown/pull/126), reviewed at `d2d1914e641ce54010742b864828bdaeac4c06fa`. It is a fresh current-main verifier fix, not a port of the legacy manifest/delegation implementation.

## Behavior

- Require issuance, expiry and resolved verifier time to be finite numeric timestamps. Reject booleans, strings, missing fields, containers and unrepresentable integers through the existing typed error.
- Validate without rewriting signed fields. Preserve integer/fractional payloads, default clock selection and acceptance at exact expiry equality.
- Preserve grant signature checks, session-key proof, API/schema and existing permissions. Deliberately expired test grants remain constructible.
- Reject malformed joins with the existing 403 and rejection evidence, without creating a session or changing a prior session on rejoin.

## Verification

- TDD: 28 failures / 9 passes before the initial fix, followed by 37 passing cases. Review identified a large-integer clock rounding regression; two new signed boundary tests failed before its correction.
- Final focused suite: **39 passed**. Full integrated suite: **500 passed**, 8 existing warnings.
- Signed malformed issuance/expiry, explicit/default invalid clocks, exact expiry, just-expired controls, unchanged payloads and expired-fixture creation are covered.
- Real in-process HTTP and SQLite tests verify 403, rejection evidence, no session on malformed join and unchanged permissions/session on malformed rejoin.
- Independent expert review passed the corrected implementation and integration with #250. The original validated integer clock is retained for comparison, preserving existing precision and expiry semantics.

## Scope and credit

Credit the author's completed namespace, manifest-tamper validator, cleanup and rebase/CI-environment follow-ups on #126. Historical approval-required CI is not a failed-test rationale for closure.

Manifest policy, hierarchical delegation, attenuation, revocation distribution and atomic budget/approval decisions remain separately designed optional profiles. This fix does not add not-before, maximum-TTL, timestamp-order or post-join-expiry policy. The source stays open until the replacement is merged with selected/deferred scope explained. No legacy contributor code or external identity/provider service was executed.