scope hashing config per verify call to stop ignore-path leak

[Support-itecz]

Summary

verifying.Config.verify carried hashing state across models when the config is reused (the module docstring recommends reusing one Config for many models):

• the guessed hashing config was cached on the instance, so a later model was hashed with an earlier model's serialization settings
• each signed manifest's ignore paths were added to that shared config via add_ignored_paths and never reset, so they accumulated across verify() calls
• an extra unsigned file placed at a path some earlier model ignored was skipped instead of reported during a later model's verification, so a tampered model verified clean

Build the hashing config per call (deepcopy a caller-supplied one, else a fresh guess) and apply the signed ignore paths to that local copy so nothing persists across calls. The regression test signs one model that ignores a file, then a second model whose signature excludes nothing, and confirms an unsigned file planted at the first model's ignored path is now reported.

Checklist

• All commits are signed-off, using DCO
• All new code has docstrings and type annotations
• All new code is covered by tests. Aim for at least 90% coverage. CI is configured to highlight lines not covered by tests.
• Public facing changes are paired with documentation changes
• Release note has been added to CHANGELOG.md if needed

[mihaimaruseac]

Thank you and nice bug catch!