Operator-caught: rung 2 demanded both public keys while the shown
command consumed only the Ed25519 one — and the gap was real: pacta had
NO SLH-DSA head-signature check (only the mirror's verify.py had one;
'--require-signatures both' refers to the empty ML-DSA slot). New:
verify_receipt(slhdsa_public_key_path=...) verifies the additive
co-signature fail-closed (absent on pre-14 heads reports absent, not
failed; unavailable OpenSSL fails closed), CLI grows
--slhdsa-public-key, rung 2's command carries the flag and its muted
text explains both checks. Proven against the LIVE log: accepted:true,
slh_dsa:verified, ed25519 on the dogfood backend. New tamper test
flips a signature byte and must be rejected. Suite 156 green.
