Function EvaluateWidgetChannelMessage

Host-side validation of one window 'message' event against the widget protocol:

1. the payload must carry one of the ready / actions / state / reply markers (anything else is 'not-widget-channel' and is ignored silently);
2. sourceWidget is the caller's resolution of event.source against its tracked widget iframes; null drops the message as 'unknown-source';
3. the payload is shape-checked and size-capped.

Never throws. Replies are NOT matched to a pending command here; the broker does that.