Verify a signed manifest's skills against the CURRENT served snapshots: each skill's signed contentHash must
equal the hash of its current snapshot. A mismatch ⇒ the served preprompt drifted after the signature was minted
(a stale/unsigned change). A skill with no declared contentHash ⇒ unpinned (drift undetectable). Snapshots are
keyed qualified "<agentKey>/<skillName>" (preferred) OR bare "<skillName>" (back-compat) — the same dual-accept
gradeAgent and resolveInstruction use, so one snapshots map feeds every consumer; a skill with no provided
snapshot is skipped (cannot be checked here).
Verify a signed manifest's skills against the CURRENT served snapshots: each skill's signed
contentHashmust equal the hash of its current snapshot. A mismatch ⇒ the served preprompt drifted after the signature was minted (a stale/unsigned change). A skill with no declaredcontentHash⇒ unpinned (drift undetectable). Snapshots are keyed qualified"<agentKey>/<skillName>"(preferred) OR bare"<skillName>"(back-compat) — the same dual-acceptgradeAgentandresolveInstructionuse, so onesnapshotsmap feeds every consumer; a skill with no provided snapshot is skipped (cannot be checked here).