feat(audit): add verification CLI

[P4ST4S]

Summary

• add streaming verification for JSONL and SQLite audit artifacts
• validate Integrity v2 and legacy signatures without modifying evidence
• report verified, invalid, legacy, and unsigned counts in text or JSON
• provide stable exit statuses for automated integrity gates

Test plan

• GOCACHE=/tmp/mcp-audit-go-cache go test -race ./...
• GOCACHE=/tmp/mcp-audit-go-cache go build ./...
• GOCACHE=/tmp/mcp-audit-go-cache go vet ./...

Stability impact

This adds the verify command as an additive CLI surface. Its text counters, JSON fields, and exit statuses are documented in STABILITY.md.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 70.56604% with 78 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/audit/verify/sqlite.go	62.88%	19 Missing and 17 partials ⚠️
cmd/mcp-audit/verify.go	66.66%	15 Missing and 8 partials ⚠️
internal/audit/verify/jsonl.go	64.00%	5 Missing and 4 partials ⚠️
internal/audit/verify/verify.go	88.88%	5 Missing and 3 partials ⚠️
cmd/mcp-audit/main.go	0.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!