Re-check an archived certification report's integrity digests. The report is
read as inert JSON text; every stored SHA-256 (the top-level receipt plus the
manifest and host fingerprints) is recomputed from the report's own canonical
content and compared. Any mismatch — a tampered snapshot, a swapped digest, or
an edited diagnostic — yields a structured rejection. No plugin code runs.
Re-check an archived certification report's integrity digests. The report is read as inert JSON text; every stored SHA-256 (the top-level receipt plus the manifest and host fingerprints) is recomputed from the report's own canonical content and compared. Any mismatch — a tampered snapshot, a swapped digest, or an edited diagnostic — yields a structured rejection. No plugin code runs.