Rebased #5187 onto 9afa1266. Landing the signed-role rule only: an existing
object that gains form or annotation keys is judged by what it was when
signed, and a signed annotation turned into another kind is no comment.
The two P1 regressions the original PR carried are not landed: the signature
decision still reads the new /FT (a signed widget relabelled as a text field
is not signing), and the dropped-/Fields check runs before the form-key
comparison (already carried by #6358's lost_entries).
Co-Authored-By: LetoCoder26 <leto@lvanwesten.eu>