CR-081: Document signed validation_result verification example

[coreytshaffer]

Summary

Adds CR-081 as a reviewer-facing documentation slice for signed validation_result verification.

This documents how operators can inspect signed validation-result ledger evidence using:

tc audit --verify-signatures --kind validation_result

The example keeps the readout metadata-only and reinforces that signatures provide provenance, not approval, safety, or correctness.

Scope

• Adds a signed validation_result verification example

• Shows safe metadata-only pass/fail output

• Documents safe failure reasons such as:

  • signature_mismatch
  • unknown_agent
  • revoked_agent

• Updates backlog/changelog status

Non-goals

• No new signed event types
• No runtime key rotation
• No private key exposure
• No raw prompt/data persistence
• No change to approval or safety semantics

Validation

• git diff --check
• python -m pytest tests -q