Add chronicle verify-raw to read back R2 artifacts against manifests

[MaxGhenis]

Closes #332.

What this adds

chronicle verify-raw is the read-only counterpart of publish-raw. It scans manifests under --root the same way. For each file entry with an R2 location, it:

1. recomputes the canonical key with the same resolve_r2_prefix/build_r2_key path publish-raw uses, country segment included;
2. streams the object back with wrangler r2 object get --remote --pipe;
3. compares its SHA-256 and size with the manifest, and with the local file if present.

It never writes to manifests or to R2. The JSON report gives one status per entry: verified, key_mismatch, digest_mismatch, size_mismatch, missing_remote, no_r2_location, fetch_error or invalid_manifest. The command exits 0 only when every entry is verified and the scan reported no errors.

That report is a receipt anyone with read access can regenerate. Five independent reviews of the NZ packages (#328, #329, #330) noted that the R2 upload and read-back were only attested in prose.

Live run (hub, with R2 read credentials, at this branch's code)

Root	Result
db/data/ird/wage_salary_distribution_2026	1 entry, verified
db/data/stats_nz/household_net_worth_2024	1 entry, verified
db/data/treasury/estimates_of_appropriations_2026_27 (--r2-prefix raw/nz)	2 entries, verified
db/data/ird/taxable_income_distribution_2025	1 entry, verified
db/data/mbie/tenancy_bond_rents_tla_2026	1 entry, verified

Negative checks ran on scratch copies of the IRD manifest:

• Key without the nz segment (raw/ird/…, where a stray copy of the object actually exists): key_mismatch, exit 1.
• Canonical key for an object that doesn't exist: missing_remote, exit 1. Wrangler's real "The specified key does not exist" message is recognised.
• An all-digit hash, which YAML parses as an integer: invalid_manifest.

No manifest changed during any run.

Invariants and how they're checked

• Read-only. No file under the root changes, including on failure paths, and the fake wrangler receives only get. There are snapshot tests, and a mutant that writes a sentinel file fails them.
• verified means the key, digest and size all match. A mutant forcing every status to verified fails 10 tests.
• Determinism. The report is identical across runs for a fixed fake remote, and entries keep publish-raw's scan order. A mutant reversing the order fails.
• Property test over seeded random payloads. Verification passes exactly when the remote returns the manifest's bytes at the canonical key. It fails with the matching status for a flipped byte, a truncated payload, a missing object or a wrong-prefix key.
• The incident as regressions. An object present only at the legacy raw/ird/… key reports missing_remote, and a manifest declaring the legacy key reports key_mismatch.

Tests

• tests/test_chronicle_verify_raw.py: 25 passed. The build lane ran it, and the hub re-ran it.
• Six in-memory mutants kill all 25 cases, with no setup errors.
• tests/test_chronicle_artifacts.py still passes (36).
• Ruff check and format pass on the changed files.
• publish-raw is unchanged. On current main it already refuses a declared key that differs from the recomputed one before uploading, so the incident in Add chronicle verify-raw to read back R2 artifacts against manifests #332 needed an older installed chronicle.

Chronicle governance

This is repository tooling, not a source package. The closest approved role is ledger-contract-maintainer, but this PR changes no schema, identity, provenance or consumer contract. It adds a read-only CLI command and its tests in chronicle/artifacts.py, chronicle/cli.py and chronicle/harness.py, plus README and changelog lines. No facts or bundle pins change.

Built by a GPT-6.1 Sol lane from the NZ hub's brief. The hub verified the tests and ran the live checks above. An independent review follows before merge.

🤖 Generated with Claude Code

[MaxGhenis]

Merged by the NZ hub (session local_e407a527) at 6b2a859 with --merge. Gates: gh pr checks exit 0; MERGEABLE; not draft; no CHANGES_REQUESTED review. Reviewed head: 6b2a859. Independent GPT-6.1 Sol review at 6b2a859: APPROVE_WITH_NITS, Needs Max: no (25 new tests and 36 existing pass; eight in-memory mutants kill all 25 cases; argv handling, read-only behaviour and size-versus-digest precedence probed). The hub also ran the command live against R2: six NZ objects verified, and legacy-key and missing-object cases refused. The review's diagnostic nit (ANSI codes inside the missing-object phrase, and over-broad NoSuchKey matching; both still report invalid) goes to a follow-up.