Bootstrap reproducible verification toolchain

[kaikisegfault]

Linked work

Closes #4

Outcome

A supported Linux x86_64 clean clone now has one command, tools/verify.sh, that installs hash-pinned CMake/Ninja tools in an isolated cache, verifies and builds pinned libsodium 1.0.22 source, and runs the C++20 and Python protocol-vector checks through CTest.

Scope

• Add CMake/CTest and Ninja presets for GCC, Clang, ASan, and UBSan.
• Pin CMake 4.4.0, Ninja 1.13.0, and libsodium 1.0.22 with SHA-256 checks.
• Remove the Python cryptography dependency and load the exact CTest-built libsodium library.
• Add the four-job GitHub verification matrix and build/toolchain documentation.
• Accept ADR 0005 and update the durable project handoff.

No ledger transitions, networking, persistence, tokenomics, or deployment are included.

Protocol and compatibility impact

ADR 0005 integrates the strict Ed25519 provider required by ADR 0004. Protocol bytes and acceptance vectors are unchanged. The implementation now compiles against pinned libsodium headers rather than hand-declared runtime ABI symbols.

Verification

• PROTOCOL_STACK_PRESET=gcc-debug tools/verify.sh: 2/2 CTest tests passed with GCC 12.2.0.
• PROTOCOL_STACK_PRESET=gcc-sanitizers tools/verify.sh: 2/2 passed with ASan and UBSan.
• PROTOCOL_STACK_PRESET=clang-debug tools/verify.sh: 2/2 passed with Clang 14.0.6.
• PROTOCOL_STACK_PRESET=clang-sanitizers tools/verify.sh: 2/2 passed with ASan and UBSan.
• Python bytecode compilation and POSIX shell syntax passed.
• CMake preset JSON, TOML, workflow/issue YAML, and internal Markdown links parsed successfully.
• git diff --cached --check passed.

Risks and follow-up

The initial reproducible bootstrap supports Linux x86_64 and needs HTTPS on its first run. Other platforms require pinned tool artifacts and CI evidence. Issue #6 owns the next canonical ledger-transition specification slice.

Checklist

• The change is focused and contains no unrelated user work.
• Specifications and ADRs match consensus-visible behavior.
• Existing negative, boundary, and adversarial primitive vectors pass.
• All required verification passed in the current working state.
• Documentation and current-state.md are accurate.
• No AI author, committer, or co-author attribution was added.