Validate an inbound request envelope.
payload stays unknown on purpose — its shape is the task's business, and
the task registry is what knows which task expects what. Everything the host
loop itself dereferences (job, task, taskVersion) is checked here,
which it previously was not: the loop read them off an unvalidated object and
handed payload to task.run as never.