Function verify_attestation 

pub fn verify_attestation(
    op_pubkey: &[u8],
    attest_fingerprint_b64: &str,
    attest_sig_b64: &str,
    sender_session_did: &str,
    local_fingerprint: &[u8; 32],
) -> Result<(), VerifyError>

Verify a received attestation (amendment §C steps 4–6). Fail-closed.

• op_pubkey — the inline operator pubkey the op-chain already verified to commit to the sender’s op_did (and to have the same op_did as the receiver; that same-operator check is the caller’s, done before this).
• attest_fingerprint_b64 / attest_sig_b64 — the card’s two fields.
• sender_session_did — the did of the card being evaluated.
• local_fingerprint — the receiver’s OWN fingerprint, recomputed from its local platform sources. The source of truth for “what is my machine”.

Strict byte-equality on the fingerprint — no prefix / no “or-better”.