Certificate verification

Nothing is auto-approved. Extraction is AI; every comparison in the report is deterministic code against the versioned ruleset, and a named reviewer records the final decision.