Offline receipt verification cannot be completed by a third party

The specification for receipts describes six steps for verifying one offline. Two of them — replaying the server's chain and confirming the receipt's signing key was active in it — cannot be performed by anyone who has not compiled the Rust crates.

The replay itself ships: `cyphr tx verify` loads a principal and replays its commits, verifying every signature. The blocker is getting a server's chain into a form it can load.

`cyphr import` resolves genesis from exactly two sources — the local keystore, or key material embedded in the first commit — and takes no flag to supply one (`rs/cyphr-cli/src/commands/common.rs:115-119`). A server's chain offers neither: `build_genesis` passes no embedded key and hands genesis in out-of-band (`rs/cyphr-server/src/auth/principal.rs:397-441`). So the ingestion fails with a message about being unable to determine genesis keys from storage.

A client's chain does embed genesis, so this is specific to ingesting a *server's* chain — which is the case the verification steps exist for.

## Why it matters

Skipping those two steps means trusting the discovery endpoint's claim about which key is current. That is precisely what replaying the chain exists to avoid: the point of the exercise is to verify a receipt without trusting the server that issued it.

So a third party who wants to check a receipt independently can do the parts that need no chain, and is blocked on the parts that make the check meaningful. Every API the workaround needs is public; what is missing is a way to hand an externally fetched chain to the verifier, or a genesis flag on import.

Read rs/cyphr-cli/src/commands/common.rs:115-119 and rs/cyphr-server/src/auth/principal.rs:397-441, then trace how cyphr import and cyphr tx verify obtain and use genesis data. Test ingestion of a server chain fetched externally; done means the chain loads without relying on the discovery endpoint and offline receipt verification can replay it and confirm the signing key from the chain.

Written by the indexing model from the issue text.