Function isSigningIdentity

Whether value is a complete Identity rather than the read-only half of one.

All four members are checked because all four are load-bearing — signerSession in particular, which an interactive refund needs and which a watch-only identity lacks. A partial identity satisfies a pubkey check happily and then fails as a TypeError deep inside a signing path, where callers read it as retryable.

One shared guard: two copies drift, and the copy that is not updated when Identity gains a member is the one that lets a watch-only identity through.