Function verify_record 

pub fn verify_record(
    root: &Path,
    record: &Path,
    git_sha: &str,
    recorded_at: u64,
) -> Result<Verified>

2026-09-26: Verify a record’s .sig sidecar against git_sha.

recorded_at is used only for the SIGNATURE_REQUIRED_AFTER exemption. Errors name the cause: no sidecar after the cutover, an unknown format version, a key file missing from REGISTRY_DIR, or a signature that does not match. check_one adds any error to the record’s failures.