Function verify_subagent_spawn 

pub fn verify_subagent_spawn(public_key: &[u8], spawn: &SubagentSpawn) -> bool

Verify the provenance signature on spawn against an encoded public_key. Use &spawn.signed_by for self-verifying signatures.

Returns false on any decode failure or signature mismatch — never panics.