VerifyDocument class

cux_ship verify --json.

checked and skipped are the point, not ok. A caller reading ok: true alone has learned nothing about coverage — which is the defect the prose version was changed to close, when a clean run printed one line and a reader could not tell whether the data safety declaration had been validated or silently passed over.

checked alone was not enough either, and the consumer said why: a reader notices an omission only by already holding the expected set in their head, so a check that silently did not run is invisible unless somebody is keeping the list. skipped makes it impossible to miss rather than merely possible to catch — absence stops being inferred from what is not in a list, which is a thing nobody does reliably.