sdk(P1.5): on-chain anchor verification with zero heavy dependencies

verify_anchor_onchain / verifyAnchorOnchain / VerifyAnchorOnchain check an
anchor epoch against the chain itself in all three SDKs: one raw JSON-RPC
eth_call to the anchoring contract's getCommitment(batchId) comparing the
on-chain merkle root with the anchor's merkle_root, plus one
eth_getTransactionReceipt confirming status == 0x1 in the expected block.
The customer chooses the RPC endpoint — nothing asks Attesto to confirm
Attesto, and no web3/ethers dependency is added anywhere.

The getCommitment(string) selector (keccak256 first 4 bytes = a7b09e2a) is
pinned as a constant with the dynamic-string ABI encoding done manually;
a worked calldata example (computed once against web3 keccak) is asserted in
all three test suites, and APSProvenance.abi.json is copied into each SDK's
testdata with a test that flags the pinned selector for review if the ABI's
getCommitment signature ever changes. The contract address is read from the
anchor epoch's hashed payload (payload.contract_address).

Mocked-RPC tests cover match / root-mismatch / failed-tx / wrong-block /
missing-fields in each language with identical problem strings; a live test
against the production contract runs only when ATTESTO_LIVE_RPC_URL is set.
Go CLI gains `attesto anchors verify <id> --rpc-url <url>` (API fetch +
on-chain check in one step; existing get/remote-verify behavior unchanged).
READMEs updated per SDK.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -129,6 +129,28 @@ client, _ := attesto.NewClient(apiKey, attesto.WithHeadStore(attesto.NewFileHead
 client, _ = attesto.NewClient(apiKey, attesto.WithHeadStore(nil))
 ```
 
+## Verify anchors on-chain
+
+`VerifyAnchorOnchain` checks an anchor epoch against the chain itself — one raw
+JSON-RPC `eth_call` to the anchoring contract's `getCommitment(batchId)`
+(comparing the on-chain merkle root) plus a transaction-receipt check (status,
+block). No web3 dependency; the RPC endpoint is yours, so this never asks
+Attesto to confirm Attesto.
+
+```go
+anchor, _ := client.GetAnchorEpoch(ctx, "aep_...")
+report := attesto.VerifyAnchorOnchain(ctx, anchor, "https://polygon-rpc.example", 15*time.Second)
+if !report.OK {
+	log.Fatalf("anchor failed on-chain verification: %v", report.Problems)
+}
+```
+
+CLI equivalent (fetch + on-chain check in one step):
+
+```bash
+attesto anchors verify aep_... --rpc-url https://polygon-rpc.example
+```
+
 ## Receiving Attesto webhooks
 
 ```go