Validation helpers for workflow-declared signal contracts.
Workflows may declare signal names with built-in type validators or an MFA
validator. A workflow that omits :signals remains open for compatibility;
once the option is present, undeclared names are rejected.