huddle 0.7.11: max accepted skew between signed_at_ms on a signed
envelope and the receiver’s wall clock. Anything outside the window
is rejected as a replay (or as a clock that’s drifted too far).
Wrap a RoomMessage into a SignedRoomMessage using the given
identity’s signing key. Mirror of verify_signed; symmetric helper
so phase B/F/G/etc. don’t each open-code the base64 dance.
Same as verify_signed but with an explicit clock and window —
kept public for tests that want to exercise the replay-window logic
deterministically without a SystemTime detour.