Define fail-closed semantics for direct VerifierRegistry calls

[cmungall]

Priority: P1

Problem

Issue #12 makes the high-level verify_document(), verify_file(), and CLI paths fail closed when parsing reports errors. However, the exported low-level VerifierRegistry.verify() method still accepts a Document with diagnostics and invokes verifier plugins directly. A caller can therefore accidentally bypass the executable-document safety gate with default_registry().verify(parse_document(source)).

The current documentation will distinguish this low-level dispatch API, but the public contract should make the safe path difficult to bypass accidentally.

Acceptance criteria

• Decide whether VerifierRegistry.verify() should enforce parser-error gating, require an explicitly validated document, or become an internal/clearly unsafe dispatch primitive.
• Public APIs for ordinary parsed input fail closed by default.
• Avoid duplicate parser findings when verify_document() delegates to the registry.
• Document the chosen high-level versus low-level contract.
• Add regression tests proving malformed documents cannot execute through every public safe verification entry point.

Found while shepherding #44.