Integrity gate shared by every store implementation: verify that the
declared header id matches the canonical content address and, when a
provenance manifest is present, that it validates. Returns the id.
First-write-wins byte-identity is checked per store (each compares
against its own persisted representation).
Integrity gate shared by every store implementation: verify that the declared header id matches the canonical content address and, when a provenance manifest is present, that it validates. Returns the id. First-write-wins byte-identity is checked per store (each compares against its own persisted representation).