Rekor: full Merkle inclusion proof verification

## Description

`src/ledger/transparency.rs` line ~109 has a TODO for full Merkle inclusion proof verification (T096). Currently, the code validates the format of Rekor responses but does not cryptographically verify the inclusion proof against the signed tree head.

## Requirements

- Implement RFC 6962-style Merkle inclusion proof verification
- Verify that the returned log entry hash matches the expected hash
- Verify the inclusion proof path from leaf to signed tree root
- Verify the signed tree head signature against Rekor's public key
- Handle proof verification failures gracefully (reject the entry, log the failure)

## Success Criteria

- [ ] Full Merkle inclusion proof verification implemented
- [ ] Rekor signed tree head signature verified against pinned public key
- [ ] Integration test submits entry to Rekor staging, retrieves inclusion proof, and verifies it
- [ ] Test with tampered proof data (must reject)
- [ ] `cargo test` passes with zero regressions

## Testing (Principle V)

- Submit real entries to Rekor public staging instance
- Retrieve and verify inclusion proofs
- Tamper with proof data and confirm rejection
- Test with valid Rekor production entries (read-only verification)