feat(federation): verify materialised parent corpora

[tcballard]

Summary

• parse the operational .decided/corpus.md manifest with the exact lowercase ## inherits and ## overrides contract
• require one bounded, materialised, non-transitive parent with explicit distinct corpus.source identities
• reject absolute paths, traversal, path escape, and symlink traversal before composition
• verify a captured immutable parent snapshot with the versioned SHA-256 digest protocol
• add the read-only decided corpus digest --root … --corpus … operator command

Stack

• Depends on feat(engine): add source-aware corpus identity substrate #454
• Part of corpus-federation: source-aware read model, resolution, routing, and enforcement #270
• This slice verifies and snapshots the parent but does not activate federated reads

Validation

• cargo test --workspace --release --no-fail-fast
• cargo clippy -p asdecided-core --lib --tests -- -D warnings
• cargo clippy -p decided --all-targets -- -D warnings
• cargo clippy --workspace --release --no-deps -- -D warnings
• federation loader integration tests: 10 passed
• git diff --check