Mandato AR Intent Mandate scope (SKU#19) — verify allowlist+budget+expiry+signature. Does not create or sign.