CI verify fails for receipt-mode range trailers (passHash ≠ merge-base..HEAD) #8

Problem

PR CI (know-code verify) fails after a normal range quiz → know-code commit → push, while local verify passes.

Root cause: pass-time range hash included staged: material; after commit CI only has merge-base..HEAD (no gitignored range-seal.json / gate.json). Local green path used range-seal-pass. Default pull_request checkout is also a merge commit without trailers.

Seen on #7: expected 104454c6… (merge-base..HEAD), trailer was passHash 4a6e5b6a….

Fix

1. Tree-canonical range hash: fromOid^{tree} → write-tree (stable staged↔committed)
2. Workflow: checkout pull_request.head.sha, write requireTrailer: true
3. scripts/smoke-verify-ci.sh — e2e without local seal artifacts
4. Docs: website/docs/verify.md

Acceptance

• npm run smoke:verify green (strip .know-code seals after commit, then verify)
• Unit tests for staged→committed hash stability
• Dogfood PR itself goes green on the know-code check without relying on local seal files

Related: #6 / #7 (Actions bumps). Threat model: CI proves trailer↔tree match only — not comprehension.