Implement precise verification reports and corruption refusal

[flyingrobots]

Outcome

Verify content and store structure at explicit depths, report exactly what was established, and refuse when evidence is missing, conflicting, or corrupt.

Dependencies

Blocked by #15, #16, and #17.

Acceptance criteria

• Verification policy uses explicit enums rather than boolean flags.
• Reports distinguish framing, checksum, chunk identity, layout identity, complete blob identity, catalog reachability, and retention-root verification.
• Partial verification cannot be presented as complete verification.
• Expected and observed identities, lengths, generations, or format versions are retained in typed failures where safe.
• Missing content is distinguished from corrupt content and ambiguous conflicting content.
• Verification never silently repairs, substitutes, quarantines, or rewrites physical state.
• Every durable structural field has permanent corruption mutations.
• Verification memory, I/O, and complexity are documented and bounded.
• Reports contain no plaintext content, keys, or unbounded sensitive paths.
• The Golden File Worldline corruption assertions pass.

Non-goals

• Automatic repair.
• Remote attestation or cryptographic proof systems.
• Application-level trust decisions.
• Garbage collection.