Verify a receipt

Verify any Glacis-signed evidence offline. Drop a signed JSON file (receipt, intent declaration, runtime review, framework report). Signature is verified against the issuer's public key — no network calls.