fix(cli): align MCP audit verdicts with anchors

[LunaMeerkats]

Summary

Make sysknife_audit_verify resolve the configured checkpoint anchor once and use the same combined verdict rule as sysknife audit verify --json.

• an empty unanchored store now reports cannot_verify through MCP instead of intact
• a hash-valid retained prefix that is behind its checkpoint now reports broken
• the MCP response exposes the CLI-compatible audit_anchor object while retaining its existing flattened chain, approval, binding, attribution, and host fields
• the existing broken-over-inconclusive precedence remains shared rather than copied

This combines the two gaps requested in #478 and #466. Closes #478. Closes #466.

Related Issue

• MCP audit verify ignores the checkpoint anchor, so a truncated chain reports intact #478
• The MCP audit-verify tool keeps reporting intact over an erased store after #461 #466

Validation

• Tests added or updated
• Documentation updated if behavior changed
• Security impact considered
• Trust boundary preserved (daemon remains the only privileged executor)
• CI passes

Executed from WSL at base f22a6abd and head d9fd70d:

• cargo test -p sysknife-cli --bins --tests --locked: 303 passed, 1 documented live-Postgres test ignored, 0 failed
• cargo clippy -p sysknife-cli --all-targets --locked -- -D warnings: passed
• cargo fmt --all -- --check: passed
• git diff --check: passed
• python scripts/check_evidence_claims.py: passed

Mutation proof: replacing the shared combined verdict with the chain-only exit code made both new regressions fail: empty/unanchored returned intact instead of cannot_verify, and the truncated anchor returned intact instead of broken. Restoring the hunk returned both to green.

The broader cargo test --workspace --locked attempt stopped during dependency build because this WSL environment lacks the GTK/GLib development packages (glib-2.0, gobject-2.0, and gdk-3.0). cargo nextest is not installed here. Per the documented fallback, I left the generated workspace-test evidence and prose totals untouched for the maintainer/CI environment.

Notes for Reviewers

AuditVerifyReport does not literally mirror every nested CLI JSON field: it preserves its established flattened MCP fields. Its contract now explicitly promises the same headline verdict and audit_anchor cross-check, and those are generated by shared CLI helpers.

This pull request was prepared and published autonomously with Codex under the LunaMeerkats account. No generated output was accepted without inspecting the diff and running the checks listed above.

[LunaMeerkats]

Hosted Rust validation has now measured the full workspace at the exact head:

1875 tests run: 1875 passed, 6 skipped
test_baseline: rust suite has 1875 tests, baseline says 1873

The two-test delta is exactly the two regressions added here; the run reports no test failure. This environment could not make that measurement locally because the WSL GUI development libraries are absent. Under the documented CONTRIBUTING.md fallback (lines 162-168), I have left workspace-tests.json and the three prose figures untouched for maintainer regeneration rather than copying or estimating metadata from CI.

All other completed executable checks are green; container-smoke is skipped and Rust CodeQL is still pending at this observation. No branch update was made.