Add `dew verify` for full manifest, image, archive, and restore preflight validation

[vedanta]

Problem

dew doctor is useful for diagnosing the current repo, but it is optimized around finding the first blocking problem. Dew also needs an explicit verification command that users can run before trusting an image, before syncing, or after pulling an image from a remote.

This is about operator confidence: users should be able to verify that the manifest, encrypted image, archive contents, and restore plan are sane without changing the working tree.

Proposed command

dew verify
dew verify --image
dew verify --manifest
dew verify --remote
dew verify --json

Suggested behavior

dew verify should check:

• .dew/manifest.yaml exists and validates
• project/image/allow/deny values are safe
• image exists for the current repo
• image decrypts with the local identity
• image decompresses successfully
• archive entries are safe and do not escape the restore root
• restore classification can be computed without writing files
• if a remote is configured, optionally verify the remote image exists and is readable

Acceptance criteria

• dew verify performs a read-only end-to-end validation for the current repo.
• dew verify --json emits machine-readable output for automation.
• The command exits non-zero on validation failure.
• The output clearly distinguishes manifest problems, identity problems, image corruption, wrong identity, restore conflicts, and remote problems.
• Tests cover valid image, missing image, wrong identity, corrupt image, invalid manifest, and unsafe archive entries.

Notes

This should not replace dew doctor; doctor should remain user-guided diagnosis, while verify should be explicit validation/preflight.