Verify authorization provenance.

Reads finalized Studionet state only. A release ref match is necessary but no longer sufficient: the candidate manifest and evidence root must also be bound.