pub(crate) fn smoke_verify(canonical: &[u8], signature: &[u8]) -> Result<()>
Structural smoke verify: byte-stable canonicalize round-trip + schema parse + non-zero sig. No cryptographic verification.