Verify normalized task approval facts and preserve signed source types

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

src/secrets_engine/approval_consume.py

@@ -382,7 +382,8 @@ def authorize_action(
         ),
         decision_id=validated.decision_id,
         expires_at=validated.expires_at,
-        artifacts=json.dumps({"request":expected_request,"claim":observation.claim,"envelope":envelope},
+        artifacts=json.dumps({"request":expected_request,"claim":observation.claim,"envelope":envelope,
+                              "authenticated_envelope_json":getattr(envelope,"authenticated_json","")},
                              sort_keys=True,separators=(",",":"),allow_nan=False),
     )