Function decode 

pub fn decode(bytes: &[u8]) -> Result<ParsedBundle, SealError>

Decode + validate a bundle file: check magic + version before JSON parse, then parse the body and verify the embedded header round-trips.

Errors

Returns SealError::Format for a bad magic / unknown version / malformed JSON / mismatched header, all fail-closed (no panic, §1.3).