Implement durable verification reports at explicit achieved depths

Problem and outcome

The 2026-09-30 audit of completed ROADMAP entries identified this obligation. Roadmap: T-21.1; KEEP-VERIFY-006. Source: docs/audits/completed-roadmap-2026-09-30.md and the original task fields in ROADMAP.md on feature/roadmap-m4-tasks. Those original criteria remain authoritative.

Expose truthful verification evidence for durable segment, catalog, and retention subjects.

Scope

Add bounded durable verification interfaces using the existing policy/report domain; distinguish requested and achieved depth and prevent unsupported escalation.

Acceptance checks

Reports cover the originally required durable subjects/depths.
partial evidence cannot construct complete verification.
public API and compile-fail laws enforce report construction rules.
typed missing/corrupt/ambiguous/operational failures remain distinct.
document I/O, memory, allocation, complexity, and source preservation.
KEEP-VERIFY-006 becomes Implemented.

Prerequisites and relationship to existing work

#20 is the existing verification parent. Durable subject admission and reader-fence code must be present; do not infer extra prerequisites merely from shared files.

These are evidence-backed prerequisite proposals, not a claim that GitHub already records dependency edges. Parent grouping and shared files do not themselves imply ordering.

Exclusions

No repair, GC execution, remote attestation, or arbitrary new verification policy.

Merge boundary and definition of done

One coherent PR delivers this observable outcome and leaves the target branch building and passing relevant checks. Preserve exact-byte identity, canonical formats, refusal precision, bounded resource use, and documented recovery. No broken intermediate mainline state is acceptable. Use the pinned Rust toolchain; run fmt, Clippy with warnings denied, and appropriate debug/release failure-mode checks. Cite concrete evidence, update the roadmap/ledger only when the original criteria are met, and retain issue → PR → integration-commit traceability. Do not treat an unmerged local change as delivered.