Add deliverable verification gate

[JSv4]

Summary

• add a deterministic verifyDeliverable gate with standard, strict, and report-only policy modes
• distinguish new, pre-existing, and resolved findings with stable structured identities
• combine corrected bounded package inspection, Open XML validation, relationship-reachable Word closure, workflow checks, and exact package/semantic delta policy
• validate digest-bound PDF/HTML/PageMap metadata and renderer diagnostics without claiming visual fidelity
• bind session verification to the exact clean Save(false) bytes returned for delivery
• contain recoverable SDK/detector failures as unavailable evidence while propagating fatal/control-flow exceptions
• enforce exact Transitional/Strict OPC owner/type/content/root topology and fail closed at work/finding caps
• document the .NET API and publish the v1 JSON Schema

Stack

This draft is based on agent/issue-457-semantic-diff (PR #494), including corrected #493 head 1612437.

Verification

• focused verifier/hardening: 36 passed / 0 failed
• package/semantic/session/PageMap matrix: 493 passed / 0 failed
• full suite: 3,913 passed / 3 pre-existing skips / 0 failed
• artifact generation: 1 passed / 0 failed
• independent final review: approved after exact relationship, pre-admission cardinality, and finding-cap regressions
• 5 generated reports validate against the checked-in schema
• artifact checksum manifest and patch reverse-check pass

The viewable local evidence index is retained at /tmp/docxodus-463-artifacts/index.html, including before/after PDF and DOCX files, the exact-byte report, complete patch, TRXs, and prior diagnostic history.

Closes #463