feat: add workload-authenticated result API

server/domain/result.go

@@ -79,6 +79,10 @@ type ResultReceipt struct {
 	CommittedAt    time.Time
 }
 
+// ResultDigest exposes the canonical payload digest to transport adapters;
+// callers still need the domain validation and workload binding policy.
+func ResultDigest(result MatchResult) [32]byte { return resultDigest(result) }
+
 type ResultStore struct {
 	expected WorkloadBinding
 	receipts map[string]ResultReceipt