[Advanced] Standalone offline LCP conformance verifier (zero backend dependency)

[Eras256]

Context
Contextio's Legal Context Protocol (LCP) documents are published at /.well-known/contextio-legal-context.json and are meant to be independently verifiable: recompute the SHA-256 of the document's canonical JSON form and compare against its declared atrHash. The exact canonicalization + hashing already exists in packages/sdk/src/lcp.ts (canonicalize / hashLegalContext / verifyLegalContext) — but only as a library import inside the JS SDK. There is no standalone tool a third party (an auditor, a counterparty, a regulator) can run without pulling in the whole SDK or trusting Contextio's own servers to self-report validity.

Scope
A zero-backend-dependency CLI that:

1. Takes a tenant domain or direct URL.
2. Fetches the published LCP document.
3. Fetches the terms document it references.
4. Recomputes the hash using the same canonicalization rules as lcp.ts (port or reuse verbatim).
5. Reports PASS/FAIL against the declared atrHash, with a clear diff on failure.

Acceptance criteria

• Runs against the live public demo tenant with zero config and correctly reports PASS.
• Fixture tests include at least one deliberately-tampered document that must FAIL.
• Non-zero exit code on FAIL (feeds directly into the GitHub Action issue below).

References
packages/sdk/src/lcp.ts and packages/sdk/src/lcp.test.ts for the exact algorithm and existing test fixtures to reuse.