Function forged_sender_ask 

pub fn forged_sender_ask() -> Chunk

Same security property as forged_sender_send, via Opcode::Ask.

Covers the request half of S1 on the RPC path: a forged make_msg.sender is stamped away before the server observes the hop. Reply authenticity (S2, sender == target) is covered separately by mailbox unit tests (ask_requires_reply_from_target).