STM full verification landing — milestones C/D/E complete

Implemented the remaining STM verification layers:

- internal/stm/lottery.go: EvaluateSigma (Blake2b-512 lottery draw) +
  IsLotteryWon with Taylor-series threshold comparison (ported from
  mithril-stm::eligibility), big.Rat-based to match Rust's num_bigint/
  num_rational path
- internal/stm/merkle.go: Blake2b-256 Merkle batch-proof verification,
  faithful port of mithril-stm's verify_leaves_membership_from_batch_path
  including the 'current is left/right child' branch logic and the
  1-byte zero pad for missing siblings
- internal/stm/verify.go: top-level stm.Verify(msg, ms, avk, params)
  glues all four checks: k-threshold, lottery, Merkle, BLS aggregate
- cmd: 'verify head' now runs full STM verification; JSON output shows
  signers, wins, params, verified flag
- MCP: new 'mithril_verify_certificate' tool dispatches genesis Ed25519
  vs STM by cert kind

Verified against live networks:
  mainnet head cert bc00b551…  epoch=626  59 signers  1972/16948 wins  ✓
  mainnet genesis   25acfcfe…  epoch=539  Ed25519 ✓
  preprod head      dd9c4fcb…  epoch=284   2 signers    11/100 wins   ✓
  preprod genesis   69bc3bdf…  epoch=196  Ed25519 ✓

This is a consensus-correct pure-Go Mithril client. Single binary,
CGo-free, no upstream Rust dependency.

Next: full chain verification (walk head → genesis, check continuity).

README.md

@@ -18,17 +18,19 @@ static binary with no runtime dependencies — useful for:
 
 ## Status
 
-**Download + extract pipeline working. Verification is the next milestone.**
+**Full Mithril verification working — genesis Ed25519 AND STM BLS12-381 — against live mainnet and preprod.**
 
 | Piece | Status |
 |---|---|
 | Aggregator REST client | ✅ list, get, cert, chain |
-| `list` / `show` / `info` / `cert` commands | ✅ working against mainnet + preprod |
+| `list` / `show` / `info` / `cert` commands | ✅ mainnet + preprod |
 | Resumable HTTP download (single stream, SHA hook) | ✅ |
 | Streamed zstd+tar extract (tar-slip defended) | ✅ |
-| `download` — digests + ancillary | ✅ (immutables loop pending) |
-| Genesis Ed25519 verification | ⚠️ stubbed, needs signed_message derivation wired |
-| STM BLS12-381 aggregate verification | ❌ the sprint — see below |
+| `download` — digests + ancillary | ✅ (full immutables loop pending) |
+| **Genesis Ed25519 verification** | ✅ live mainnet + preprod |
+| **STM BLS12-381 aggregate verification** | ✅ live mainnet + preprod |
+| **MCP stdio server** | ✅ 7 tools, Claude/Cursor/Zed compatible |
+| Full cert-chain verify (genesis → head) | ⏳ next |
 
 ## Usage