Function reference_verify 

pub fn reference_verify(bundle_data: &[u8]) -> ReferenceResult

Independent reference verifier that does NOT use the production verify_bundle path.

Reads entire bundle into memory, decompresses gzip → tar, extracts manifest.json + events.ndjson, parses with standard serde_json (no streaming), and recomputes all hashes independently.