feat: add independent receipt verifier

[MarcoPorcellato]

Summary

• establish ccp-core as the owner of canonical configuration, Matrix, receipt, schema, and pure verification contracts;
• add the physically independent ccp-verifier source-build CLI for receipt verification and schema emission;
• preserve root CLI compatibility, public error text, serialization, receipt behavior, and exit-code parity through exhaustive contracts;
• enforce a fail-closed verifier dependency policy and document the bounded M2 availability claim;
• integrate the already-merged opaque cache-payload symlink support from PR feat: preserve opaque symlinks in cache payloads #73 without weakening either boundary.

Trust claim checklist

• Public claims in this pull request do not imply:
  • native execution where only contract-level qualification is available,
  • signed identity or full execution attestation when only A0 evidence is present,
  • zero-cost operation or equivalent absolute cost reductions.
• Source, runtime, workflow, permission, secret, policy, schema, and dependency impacts are described below.
• Roadmap text is presented as planned work, not as implemented or qualified behavior.

Impact and rollback

• Runtime or trust-boundary impact: protocol and pure verification ownership moves into ccp-core; the root CLI remains the producer/operator surface, while ccp-verifier is constrained to independent verification and schema output. Exact compatibility and parity contracts cover the boundary.
• Dependency or supply-chain impact: two workspace crates are added. The verifier normal dependency closure is restricted to the reviewed ccp-core plus CLI/parsing/hash dependencies already present in the locked graph. Generated SBOM and notices are current.
• Data, secret, permission, or network impact: none. The verifier reads bounded local receipt/policy inputs and this PR adds no secret, permission, deployment, or network authority.
• Rollback path: revert this pull request as one merge unit; no schema migration, installed-producer replacement, cache migration, or published binary is included.

Evidence checklist

• Exact focused checks and full qualification results are listed below.
• Rust formatting passed for the complete workspace.
• Relevant contract tests passed; intentionally not-run gates are explicit.
• Branch and parent-relative diff checks pass.
• User-visible changes update CHANGELOG.md.
• New and changed documentation links target repository-owned authoritative files.

Validation notes

Exact PR head: 0c838017c6af840fada47889a6265502dea302cd.

• native macOS arm64 Generation 6 guard: terminal PASS, outer exit 0;
• locked workspace, all-target, all-feature tests: 479 passed, 4 ignored across 31 suites;
• full workspace Clippy with warnings denied: PASS;
• workspace documentation build: PASS;
• release metadata check: current;
• release build of ccp-verifier: PASS;
• independent merge review: APPROVED with no Critical, Important, or Minor findings;
• locked verifier dependency graph and metadata: 79 packages, 3 workspace members, 79 resolve nodes;
• metadata SHA-256: cdcce8d503998d0840a9d0981a57bd0ece842b0345cefbacb8fc2953b96941d5;
• macOS arm64 verifier size: 2,591,200 bytes;
• verifier SHA-256: 8a65d8e89973ad04f6506889b0c058cd7d83d70497114d6f408e7d7917b29bb9.

Boundaries:

• guard exec emits no CCP receipt; the configuration-backed exact-head receipt gate remains PENDING.
• Evidence publication, ready transition, merge, stable installation, tag, release, signed identity, static distribution, Windows/Linux qualification, and cross-platform claims are NOT_RUN or NOT_PUBLISHED.
• M3 distribution work and the post-M2 stable release remain separately gated.