Verify a signed evidence bundle

Recomputes the digest from the SUBMITTED components — never the supplied digest — so swapping any single part (a fee line, an on-chain check, the counterfactual, the transfer id, even the issue timestamp) invalidates it. Without that, a bundle would be a convenient vehicle for laundering a false conclusion through a genuine signature. A valid signature means the CONTENTS are authentic; it does not mean the transfer succeeded. A genuine bundle can honestly report a failure.