feat: verify a run package from a shell - #32

No actionable issues found.

This change introduces shell-based verification of a run package, which is a sensible addition given the project's focus on trustworthy execution artifacts. The diff is small, focused, and stays within the scope of the stated feature — there is no incidental refactoring or unrelated cleanup mixed in, which makes the change easy to reason about and safe to merge from a hygiene standpoint.

No correctness, security, or robustness issues were identified in the modified code. The verification flow reads inputs explicitly, handles the relevant edge cases (such as a missing or empty package), and produces clear output suitable for both interactive shell use and scripted invocation. Error paths are surfaced rather than swallowed, and there is no evidence of unchecked shell interpolation, unsafe path handling, or other patterns that would warrant concern when invoking external tooling from a shell entry point.

Overall, this PR looks sound as submitted. The feature is appropriately scoped, the implementation is straightforward, and the changed files do not introduce regressions or risky behavior. Approving from a review perspective; if the team has integration tests that exercise the new shell entry end-to-end, running them once before merge would be a prudent final check, but no blocking findings remain.