[drk-ram]

Summary

• add RFC 8785 canonicalization with SHA-256 integrity attestations for generated CycloneDX and SPDX documents
• add a --verify FILE command that validates schema requirements and checks attestations with constant-time digest comparison
• validate declared CycloneDX 1.6/1.7 versions and required SPDX 2.2/2.3 document fields
• report legacy documents explicitly as unattested while still allowing schema-only verification
• detect modifications to component hashes, licenses, and dataset metadata

Validation

• .venv\Scripts\python.exe -m pytest -q tests\test_integrity.py — passed (9 tests)
• .venv\Scripts\python.exe -m pytest -q — passed (191 tests)
• .venv\Scripts\ruff.exe check src\utils\integrity.py tests\test_integrity.py --output-format concise — passed
• regression tests against origin/main — failed as expected because the integrity module and verification path are absent

Fixes #130