feat: bootstrap integrity verification + governance certification CLI (#99)

- IntegrityVerifier: SHA-256 hash verification of governance module
  source files and critical function bytecodes against a published
  manifest. Detects supply chain tampering at startup. (Closes #95)
- GovernanceVerifier: OWASP ASI 2026 control presence checking with
  signed attestation output, coverage percentage, and shields.io
  badge generation for README embedding
- CLI: 'agent-compliance verify' and 'agent-compliance integrity'
  commands with --json, --badge, --generate, --manifest flags
- 28 tests covering hash determinism, tamper detection, manifest
  round-trip, badge generation, and CLI integration

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: imran-siddique

packages/agent-compliance/pyproject.toml

@@ -52,3 +52,6 @@ Repository = "https://github.com/microsoft/agent-governance-toolkit"
 "AgentMesh" = "https://github.com/microsoft/agent-governance-toolkit"
 "Agent Hypervisor" = "https://github.com/microsoft/agent-governance-toolkit"
 "Agent SRE" = "https://github.com/microsoft/agent-governance-toolkit"
+
+[project.scripts]
+agent-compliance = "agent_compliance.cli.main:main"

packages/agent-compliance/src/agent_compliance/cli/__init__.py

@@ -0,0 +1,2 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.

packages/agent-compliance/src/agent_compliance/cli/main.py

@@ -0,0 +1,110 @@
+#!/usr/bin/env python3
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+"""
+Agent Governance Toolkit CLI.
+
+Commands:
+    verify      Run OWASP ASI 2026 governance verification
+    integrity   Verify or generate module integrity manifest
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+
+
+def cmd_verify(args: argparse.Namespace) -> int:
+    """Run governance verification."""
+    from agent_compliance.verify import GovernanceVerifier
+
+    verifier = GovernanceVerifier()
+    attestation = verifier.verify()
+
+    if args.json:
+        print(attestation.to_json())
+    elif args.badge:
+        print(attestation.badge_markdown())
+    else:
+        print(attestation.summary())
+
+    return 0 if attestation.passed else 1
+
+
+def cmd_integrity(args: argparse.Namespace) -> int:
+    """Run integrity verification or generate manifest."""
+    from agent_compliance.integrity import IntegrityVerifier
+
+    if args.generate:
+        verifier = IntegrityVerifier()
+        manifest = verifier.generate_manifest(args.generate)
+        print(f"Manifest written to {args.generate}")
+        print(f"  Files hashed: {len(manifest['files'])}")
+        print(f"  Functions hashed: {len(manifest['functions'])}")
+        return 0
+
+    verifier = IntegrityVerifier(manifest_path=args.manifest)
+    report = verifier.verify()
+
+    if args.json:
+        import json
+
+        print(json.dumps(report.to_dict(), indent=2))
+    else:
+        print(report.summary())
+
+    return 0 if report.passed else 1
+
+
+def main() -> int:
+    """CLI entry point."""
+    parser = argparse.ArgumentParser(
+        prog="agent-compliance",
+        description="Agent Governance Toolkit — Compliance & Verification CLI",
+    )
+    subparsers = parser.add_subparsers(dest="command", help="Available commands")
+
+    # verify command
+    verify_parser = subparsers.add_parser(
+        "verify",
+        help="Run OWASP ASI 2026 governance verification",
+    )
+    verify_parser.add_argument(
+        "--json", action="store_true", help="Output JSON attestation"
+    )
+    verify_parser.add_argument(
+        "--badge", action="store_true", help="Output markdown badge only"
+    )
+
+    # integrity command
+    integrity_parser = subparsers.add_parser(
+        "integrity",
+        help="Verify or generate module integrity manifest",
+    )
+    integrity_parser.add_argument(
+        "--manifest", type=str, help="Path to integrity.json manifest to verify against"
+    )
+    integrity_parser.add_argument(
+        "--generate",
+        type=str,
+        metavar="OUTPUT_PATH",
+        help="Generate integrity manifest at the given path",
+    )
+    integrity_parser.add_argument(
+        "--json", action="store_true", help="Output JSON report"
+    )
+
+    args = parser.parse_args()
+
+    if args.command == "verify":
+        return cmd_verify(args)
+    elif args.command == "integrity":
+        return cmd_integrity(args)
+    else:
+        parser.print_help()
+        return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())