`Envelope::is_signed()` reads as a trust predicate but only checks wire shape

`Envelope::is_signed()` (`rs/cyphr-server/src/envelope.rs`) is a shape check — it returns true iff the statement's `kind` tag is `"signed"`. It does not verify the signature, the signing key, or any binding between the signed statement and the envelope's own `payload` (the spec explicitly notes there is no payload-byte binding today).

A caller that treats `is_signed() == true` (or the wire-level `kind == "signed"`) as "this response is attested" is trusting unverified data — a malicious server could attach a genuine signed statement over a *different* claim while the accompanying payload says something else. Real trust only comes from the full offline verification procedure described in `docs/specs/receipts.md` (replay the server's own chain, verify the signature against a key recovered from that replay, cross-check the claims against the payload).

Recommend renaming `is_signed()` toward something like `has_statement()` to stop it reading as a trust check, and stating loudly in `docs/specs/http-envelope.md` that the tag alone is never sufficient for verification.

Part of the server production-readiness effort tracked in #23. Discovered during the work tracked in #88.

Start in rs/cyphr-server/src/envelope.rs by tracing Envelope::is_signed() and its callers, then read docs/specs/receipts.md and docs/specs/http-envelope.md. Check how the kind tag is used and document that it is not verification; done means the predicate name and HTTP-envelope guidance no longer imply trust.

Written by the indexing model from the issue text.