Add a read-only verifier for Krad source inputs

[keys-i]

Motivation

Make the researched upstream inputs reproducible and auditable before any compiler or sysroot build consumes them.

Acceptance criteria

• krad plan reports the dependency order.
• krad verify [root] checks each source directory, exact HEAD revision, origin URL, license file, and focused paths without downloading or modifying sources.
• Both commands support JSON output.
• Invalid commands, options, arguments, and source states fail with an actionable message and non-zero exit status.