feat(eval): verify selected Branch closure with receipt v1

[runyuan-wang]

Summary

• Make layerfs-eval check <store-db> <branch-id> verify the complete object closure reachable from the selected pinned Branch's effective root.
• Reuse the existing production traversal, with checked object/encoded-byte accounting, rather than introducing a second graph walker.
• Preserve the legacy no-flag stdout bytes and add an opt-in --receipt-v1 with a deterministic nine-field canonical receipt emitted only after closure verification succeeds.
• Expand independent closure-oracle and ObjectId canonical/equivalence coverage, including missing, corrupt, malformed, shared, repeated-edge, unrelated-object and representative deep-chain cases.

Compatibility and scope

The receipt describes one pinned Branch/root, not the whole Store. The change does not alter object encoding, schema, wire format, migrations, signatures, export behavior, dependency manifests or lockfiles. Legacy check success output remains unchanged when --receipt-v1 is absent.

Design provenance and evidence boundary

This change carries forward the still-valid design discipline from merged PRs #3 and #4:

• perf(fs): optimize bytesToHex encoding #3: exact lowercase/fixed-width ObjectId representation and adversarial equivalence testing;
• Keep mini-benchmark JSON artifacts Prettier-clean #4: deterministic producer-boundary evidence, idempotence and strict declared-scope acceptance.

The three Yuan Conjecture papers informed only the bounded method discipline: work on a finite selected scope, distinguish local verification from global claims, and state nonclaims explicitly:

• Paper 1
• Paper 2
• Paper 3

They do not prove a LayerFS theorem, algorithm, performance result or novelty claim, and no collision/rank model is transferred into this implementation.

Validation

Validated from the current main parent with Cargo offline mode:

• cargo test --offline -p layerfs-content — 103 passed;
• cargo test --offline -p layerfs-layerstack-store — 47 passed, 1 pre-existing ignored;
• RUSTFLAGS='--cfg feature="macos-no-mount"' cargo test --offline -p layerfs-eval — 1 passed;
• cargo fmt --all --check — passed;
• git diff --check — passed.

The plain evaluator build on this macOS host still encounters the repository's existing fuser/missing fuse.pc host dependency; no dependency file was changed, and the repository's no-mount validation cfg was used for the evaluator test.