Verify complete execution passport artifact sets

[aantenore]

What changed

• add consumer-side verification for all Execution Passport subjects and predicate bindings
• require exact one-to-one byte matches for external execution-evidence resources
• expose the verifier through the public API and verify-passport CLI
• exercise the complete StageFabric producer-to-consumer golden path
• document the trust boundary: consistency is verified here; signer authenticity remains external

Why

Producing a Passport was not enough for a relying system to prove that it received the exact bundle, report, OASF record, and execution artifacts named by that Passport. This closes that consumer-side integrity gap without overstating authenticity.

Validation

• npm run release:check
• 99/99 tests
• 92.44% statement coverage
• production dependency audit: 0 vulnerabilities
• package, publint, type-surface, installed CLI and library smoke checks pass
• repository identity/history audit passes