contextgraph-inspect cannot check a record hash or an attestation

[macanderson]

Problem

contextgraph-inspect is the debugging binary a provider author reaches for
("analogous to MCP's inspector", per contextgraph-conformance/Cargo.toml). It
has no record-layer verb. After PR #114 the library can compute a record_hash,
print its canonical preimage, and verify a RecordAttestation, but a CEP author
holding a record and a disagreeing digest has no command to run — they have to
write a Rust program.

That is exactly the moment the tool exists for. The preimage is the thing they
need to see, because a digest mismatch says two canonicalizations differ and
says nothing about where.

Files

• contextgraph-conformance/src/bin/contextgraph-inspect.rs
• contextgraph-types/src/record_attest.rs — record_hash,
  record_hash_preimage, record_hash_is_current, verify_signed_record_hash
• contextgraph-conformance/Cargo.toml — would need the record-attestation
  feature on its non-dev dependency on contextgraph-types (it is a dev-dep
  today, added by feat(contextgraph-types): implement record_hash and RecordAttestation #114 for the test suite)
• docs/running-conformance.md — where a new verb gets documented

Proposed shape

contextgraph-inspect record hash <file.json>       # print the record_hash
contextgraph-inspect record preimage <file.json>   # print the canonical JCS bytes
contextgraph-inspect record verify <file.json>     # is the stored record_hash current?
contextgraph-inspect record attest <attestation.json> --record <file.json> --key <hex>

preimage is the one that earns its place; the others are conveniences around
it.

Reproduce

./target/debug/contextgraph-inspect --help lists no record verb.

Done

A CEP author can compute and diff a record's canonical preimage and verify an
attestation from the command line, the verbs are documented in
docs/running-conformance.md, and a test covers each one against the fixtures
in tests/fixtures/.