certifiable-verify

Pipeline verification for the certifiable-* ecosystem — because 'we checked it manually' isn't certifiable