fix: verify ledger integrity and require explicit bound resolutions

[bhyi4]

Summary

• Add one MIRROR-SPEC snapshot verifier shared by the gate and outsider CLI: recompute links and SHA-256 content seals, reject empty/missing/malformed/duplicate-key/tampered input, and report legacy seal strength.
• Require an explicit sealed result (action=result; payload.status, summary, prereg_seal) or reasoned retraction before publication. A started action cannot resolve a claim; first registration wins. Negative and inconclusive results remain publishable.
• Expose HASH_RECOMPUTED / LOCAL_SNAPSHOT / HEAD_WITNESS and unverified content truth, identity, external time and independent reproduction. A separately checked Bitcoin proof is not misrepresented as binding this ledger's precedence.
• Preserve linkage-only check_chain as a compatibility API; the CLI no longer mistakes it for content integrity. Existing production records are not rewritten.

Related

• fix: disclose verification depth and linkage-only audit scope measure-mirror#74: explicit directory audit depth (merged).
• fix: stop certifying unverified provenance markers as signed provenance-mirror#8: unverified provenance labels (merged).
• Dependency release/tag update is separate; this PR initially retains existing release pins.

Migration

Callers must append a real result with the first preregistration seal; legacy started actions do not pass. GO permits publication of a resolved result, not a claim of scientific success. No service restart or local shared-install branch change is included.

Validation

• Local full suite and dedicated online release-pin checks.
• Regressions cover content-only tampering, raw unsealed claims/actions, invalid JSON, empty/missing input, false resolutions, first-write invariance, snapshot reads, negative results and truthful verification scope.