Verify an owner-sold supply path

Joins the owner's and host's cached adagents.json manifests (plus the host's ads.txt/app-ads.txt inventorypartnerdomain lines when needed) and returns the verification state of one owner-sold carriage path, leg by leg. States follow the documented ladder: verified_owner_sold (host adagents.json authorizes the agent for the host property, collection-scoped), host_delegated (ads.txt inventorypartnerdomain + owner-side declarations, policy-gated), owner_attested (owner distribution claim only — discovery, never authorization), unverified. The response is evidence-bearing so callers can reproduce the verdict from the authoritative files; the registry cache is a convenience, not the trust root. For a live-fetch check of a file you just changed, use POST /api/adagents/validate.