shadow-attestation-verifylisted

# Shadow Attestation Verify Cryptographic verification of a persisted Shadow decision, without a network call to Shadow itself. ## When to use The user's request combines all of: 1. A JSON attestation object (from `response.attestation`) with `signature`, `mode`, `model_id`, `request_commitment`, `output_commitment`, `completed_at_utc`, `key_id`. 2. The original request body Shadow was called with. 3. The original response body, with the `attestation` field stripped (hashing an attestation into itself is a common wrong path). 4. The verification key material — Ed25519 public key PEM for procurement-mode records, HMAC secret for legacy dev mode. If any of the four is missing, ask for it. Do not fabricate. ## What it does Calls `shadow_verify_attestation` with the four inputs and returns: - **ok** — true if signature verifies + commitments match + key_id + model_id are as pinned. False otherwise. - **reason** — plain-English reason if false. One of: request tampered, response tampered, model_id substitution detected, signature invalid, wrong key. - **model_id + key_id + completed_at_utc** — surfaced for audit trail. - **interpretation** — one sentence a compliance officer can paste into an audit note. ## The named invariant **Dictionary hash is bound into the signing payload since v1.5.8.** If the reason-code dictionary was swapped between decision time and verification time, the signature will not verify — even with the correct key. This closes the "post-hoc dictiona