wrap: chain verify + manifest verify + LICENSE + final docs

- internal/chain: end-to-end chain verification. Walks head → genesis,
  verifies every cert (Ed25519 or STM as appropriate), and checks
  continuity at every boundary:
    epoch:    same or +1 from previous
    hash:     current.previous_hash == previous.hash
    AVK:      same epoch  → equal aggregate_verification_key
              new epoch   → matches previous.protocol_message.next_aggregate_verification_key
- cmd: 'verify chain' subcommand + 'verify manifest <dir>' for SHA-checking
  downloaded immutable files
- internal/manifest: per-file SHA-256 verification against the digests.json
  shipped in the snapshot's digests archive
- MCP: 8th tool 'mithril_verify_chain' for agent-driven full-chain verify
- README: complete rewrite — status table, architecture, gotchas, MCP
  tool surface, exit code contract, build instructions
- LICENSE: Apache-2.0 (matches upstream Mithril)

Verified end to end against live networks:
  preprod  chain  90 certs (89 STM + 1 genesis)  1124 wins   ✓
  mainnet  chain  89 certs (88 STM + 1 genesis)  210921 wins ✓

That's the wrap. Pure-Go consensus-correct Mithril client, single 10 MB
static binary, MCP-native, no CGo, no upstream Rust runtime.

go.mod

@@ -2,11 +2,13 @@ module git.sulkta.com/Sulkta-Coop/mithril-go
 
 go 1.26
 
-require github.com/klauspost/compress v1.18.5
+require (
+	github.com/consensys/gnark-crypto v0.20.1
+	github.com/klauspost/compress v1.18.5
+	golang.org/x/crypto v0.50.0
+)
 
 require (
 	github.com/bits-and-blooms/bitset v1.24.4 // indirect
-	github.com/consensys/gnark-crypto v0.20.1 // indirect
-	golang.org/x/crypto v0.50.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
 )