feat: add Verus workflow verification sidecar

[0dragosh]

Summary

• add a Verus sidecar workflow model and document the trusted boundaries around cwt workflow verification
• add workflow conformance tests plus a verification runner and pinned Verus dev shell
• fix snapshot restore patch application so saved diffs restore cleanly

Validation

• cargo fmt
• cargo test
• nix build
• nix build .#devShells.aarch64-darwin.verus
• nix develop -c cargo-clippy --all-targets -- -D warnings
• nix develop .#verus -c ./scripts/verify-verus.sh (currently stops with the exact rustup install command when the required Verus toolchain is missing)