Unwraps a Chronicle gRPC command/query result envelope.
Every Chronicle command (CommandResult, CommandResult_*) and query
(QueryResult_*) response is wrapped in an envelope carrying
CorrelationId, IsAuthorized, ValidationResults, and
ExceptionMessages/ExceptionStackTrace/AuthorizationFailureReason
alongside the actual payload — in a Response field for commands, or a
Data field for queries. A bare CommandResult (e.g. Redact,
RegisterEventTypes) carries no separate payload field at all.
unwrap/1 centralizes the IsAuthorized/ExceptionMessages check so call
sites don't have to repeat it, and returns the unwrapped payload — or the
envelope itself, when there is no separate payload field.