feat(cli): origin verify #57

Nothing checks a whole repository for damage. Before trusting real history to a format that is still changing, and after restoring a backup, someone has to be able to ask whether a repository is intact.

origin verify reads everything and reports what is wrong:

• every object's content matches its ID;
• every target's chain is unbroken, and every acceptance is signed by the authority its policy names;
• every record a record refers to is present, or was withheld or dropped on purpose.

It exits non-zero on any finding, so a scheduled restore drill can run it.