[cschanhniem]

Summary

This PR adds a small but high-leverage reproducibility gate: a run-manifest verifier.

The repo already generates run_manifest.json, but a manifest is only useful if someone can cheaply verify that the recorded inputs still match their hashes and that the named outputs still exist. Without that check, downstream review can accidentally trust a stale or partially missing artifact set.

Changes

• Add openamp_foundry.reproducibility.verify_run_manifest().
• Add scripts/release/verify_run_manifest.py CLI.
• Add tests for:
  • valid manifest verification;
  • input hash drift detection;
  • missing output detection;
  • optional output hash enforcement.

Why this matters

This strengthens the repository's evidence layer without adding any biological claims. It makes the existing reproducibility standard operational: the manifest becomes a verifiable object, not just metadata.

Tests

Not run locally in this environment; CI is the source of truth for this PR.