Add a read-only verifier for Krad source inputs

[keys-i]

Closes #2

Motivation

Prove source identity before any future compiler or sysroot build consumes the researched inputs.

Changes

• add krad plan with text and JSON output
• add krad verify [root] for directories, origin URLs, exact HEAD revisions, license files, and focused paths
• reject unknown commands, options, and excess arguments with non-zero exit status
• invoke Git without a shell and never modify or download source inputs

Verification

• node tools/krad.js plan --json passed with order clang, utils, musl, libs
• node tools/krad.js verify ../research --json passed for all four pinned sources
• node --check tools/krad.js passed

Risk and rollback

Verification reads local paths and Git metadata only. Roll back by reverting commit 6f4e84e.

Stack

Depends on the component graph PR; base: sources. The tests PR targets this branch.