fix(profile): add recompute-content verifier to ManifestCas (Audit #333 H7)

[vrogojin]

Stacked PR. Built atop #354 (H5) → #353 (H4) → #352 (H3) → #351 (H2) → #349 (H1) → #348 (C3) → #347 (C2) → #346 (C1).

Summary

Closes the H7 high finding of audit #333 — ManifestCas.update's precondition check compared observed.rootHash (a string read from the entry) to prev.contentHash (the caller's expected value). Both sides are arbitrary writer-supplied labels — a CAS pass meant "the labels agree", not "the content under the label is the content the caller meant". An attacker writing an entry with a forged rootHash field that doesn't match the actual pool content slipped through unchanged.

Fix

1. New optional VerifyEntryRootFn hook accepted via the ManifestCas constructor's opts.verifyEntryRoot. When wired, the hook is invoked AFTER the label CAS passes and BEFORE the write. The hook fetches the content the entry's rootHash references (production: the UXF pool element via computeElementHash), recomputes the hash, and asserts it matches the declaration.
2. New 'integrity-failed' discriminator on ManifestCasResult.reason with structured integrityDetail for triage. The result also carries observed.contentHash so callers can re-read state.
3. ManifestCidRewriteCasError.casReason widened to surface 'integrity-failed'. The worker's outer retry loop already treats any throw from manifest-cid-rewrite as a hard CAS failure that bubbles up; the new reason rides through unchanged but preserves structure for operator triage.
4. Skip conditions:
   • prev === null (asserts-no-entry) path — no observed entry to verify
   • Label-CAS mismatch — the swap has already been rejected, so the verifier short-circuits
5. Optional shape preserves back-compat: all 9 existing manifest-cas tests and 100% of production callers that do not (yet) supply the verifier continue to behave identically. Production wiring is a follow-up that does not block this PR.

Production wiring

const cas = new ManifestCas(storage, {
  verifyEntryRoot: async (addr, tokenId, entry) => {
    const poolElement = await loadPoolElement(entry.rootHash);
    if (poolElement === undefined) {
      return { ok: false, reason: 'pool-element-missing' };
    }
    const recomputed = computeElementHash(poolElement);
    return {
      ok: recomputed === entry.rootHash,
      reason: recomputed === entry.rootHash ? undefined : `recomputed=${recomputed}`,
    };
  },
});

The audit's gap (the CAS doesn't recompute) is now closed at the engine level; production wiring of the hook is the next step.

Test plan

• 6 new H7 regression tests in tests/unit/profile/manifest-cas-h7-recompute-integrity.test.ts:
  • Back-compat (verifier omitted → label-only CAS as before)
  • Happy path (verifier called AFTER label CAS, BEFORE write — explicit ordering assertion)
  • Integrity failure → 'integrity-failed', no write, storage unchanged, integrityDetail propagated
  • Skip on prev = null (no observed entry to verify)
  • Skip on label-CAS-mismatch (short-circuit before verifier — verifier never called)
  • 'integrity-failed' has its own discriminator distinct from cas-mismatch / not-found / concurrent-modification
• All 9 existing manifest-cas.test.ts tests pass unchanged
• All 1512 transfer tests pass
• All 450 unit test files (8181 tests) pass
• tsc --noEmit clean

Audit traceability

• Issue: Audit: integration/all-fixes — money-path subsystems (UXF / Profile / transfer pipeline) #333 (H7)
• File / line in audit: profile/manifest-cas.ts:139-171
• Audit recommendation followed: promote the integrity-label check to a real recomputed-content integrity check.

Stack summary

This PR completes the actionable High tier from audit #333:

Tier	PRs
Release-gate Criticals	#346 (C1), #347 (C2), #348 (C3)
Highs (this stack)	#349 (H1), #351 (H2), #352 (H3), #353 (H4), #354 (H5), this (H7)
Deferred	H6 (lamport=0 convergence), H8 (reconcile CID compare) — to be filed as follow-up issues; audit specifically flagged these as "reproduce with multi-device test matrix before fix-now"

What's next

Per user direction, H6 and H8 will be filed as deferred follow-up GitHub issues capturing the audit findings + the requirement to build the multi-device reproduction harness first.