Recompute checkpoint selection before trusting its receipt
A checkpoint-selection receipt should not be trusted merely because its selected path and hashes are internally consistent. The consumer must independently recompute the declared metric ordering and deterministic tie-break across every candidate, then require the selected artifac…