Add a verify command to rederive a lock

[timkpaine]

Two modes, mirroring manifest/sbom:

• Local (--lock <file>): compute the lock's sha256-<hex> content address. With --expect <sha256-…>, exit non-zero on mismatch. Reports whether the lock carries an embedded manifest band.
• Registry (--env --registry): resolve the release, then re-derive and check the content address of its lock and manifest sidecar against the index — reusing the verification that pull/pull_manifest already enforce, surfaced as explicit per-object OK reporting.

$ nepenthe verify --env research --registry file:///srv/reg --python 3.11
release research 1.0.0 on linux-64
  lock sha256-68f4…fed34: OK
  manifest sha256-d06c…c9ec: OK
verified

[github-actions]

Test Results

178 tests  ±0   178 ✅ ±0   3s ⏱️ -1s
  5 suites ±0     0 💤 ±0 
  2 files   ±0     0 ❌ ±0 

Results for commit fbec9a4. ± Comparison against base commit e431b65.