Free: find an existing signed verdict by content hash or package identity.

No auth, IP rate-limited. subject is a sha256:<hex> content hash, or the target ref as it was scanned (for example chalk@5.6.1). Returns the newest attestation with its compact JWS, so it can be verified offline against /.well-known/jwks.json without trusting this response. A clear or flagged verdict over a content hash is re-checked against the current known-bad set first, and contradicted is non-null when it no longer holds. stale_rules is true when it was attested under older rules. The findings and evidence are not in an attestation. When NOBODY has attested the subject and it is an npm package identity, the answer is a free identity check against the OSV / OpenSSF malicious-package corpus, carried in identity_check with found still false and answer set to identity_check. An identity check is a different and weaker thing than an attestation: it is unsigned, it looks at the package identity rather than its code, and absence from the corpus is not a verdict.