Offline DM-1 audit packet verifier — schema, payload hash, Ed25519 signature, optional OpenTimestamps