Decode shares and return the payload bytes only if they re-commit to
payload_commitment. Recovery alone does not bind the decoded bytes
to the commitment: a Byzantine disperser can commit to a non-codeword,
and a bad share poisons the erasure decoding.
Decode the shares and accept the result only if it re-commits to
payload_commitment. On failure, report the shares that fail
verification against the commitment (each share is self-authenticating
via its merkle proofs) so they can be weeded out. If every share
verifies, the payload is unrecoverable: the shares cover the recovery
threshold with disjoint ranges, so the disperser committed to a
non-codeword and no share subset can ever succeed.