Require verifier in verify.receipt and finalize provenance wording

[GsCommand]

Motivation

• Ensure verification receipts always identify the auditing actor so no anonymous or ambiguous verifier can validate a receipt.
• Remove provisional provenance wording from the repository so the provenance document reads as a completed, repository-backed release artifact.

Description

• Add verifier to the top-level required array in schemas/v1.1.0/commercial/verify/verify.receipt.schema.json and constrain it to the existing actor shape while requiring role: "verifier" via an allOf refinement.
• Rewrite SECURITY_PROVENANCE.md to remove “pending” / “CID later” language and state the repository-backed release integrity posture (current line, checksums, canonical schema paths) without asserting external pin/mirror state.
• Regenerate checksums.txt so the recorded SHA-256 digests match the updated schema artifact.
• No example files required changes because existing current-line examples already include a verifier.

Testing

• Ran npm run validate which completed successfully.
• Ran npm run validate:examples which completed successfully and reported all current-line examples validated.
• Ran npm run generate:checksums to refresh checksums.txt and it wrote updated checksums successfully.

---

Codex Task