[gby04]

What changed

• Allow authority profiles to bind the expected sync policy version and digest.
• Verify epoch root sync policy against the matched authority profile instead of only the default digest.
• Add regression coverage for custom CA broadcast policy checkpoints and evidence verification.

Verification

• powershell -ExecutionPolicy Bypass -File tools\check_format.ps1
• cmake --build build-gby -j 1
• ctest --test-dir build-gby --output-on-failure