pub fn require_blind_root(urn: &DigUrn) -> Result<Bytes32>Expand description
Rule 1: obtain the trusted root for a BLIND-tier verify, rejecting a rootless URN.
The root MUST come from the chain (the caller passes what it read from the anchor), NEVER from the
gateway. A URN with no pinned root cannot be verified blind → ResolveError::RootRequired.