federation-verify/src

@oktoid/federation-verify: the independent verifier of an OpenID Federation trust chain, as a function that returns a verdict.

It walks an entity's chain from published files alone and checks every statement with jose, sharing no code with the trust module that signed them. Two callers share it: pnpm oktoid verify-federation, which prints the report and exits with the verdict, and the setup engine's publish.federation check, which draws a row. It is not the product's relying-party verifier: it resolves neither metadata policy nor trust marks.