tests: resolve cupola-cli path at runtime (golden CLI)

epi-cli: Gate E/F (pack spec + deterministic verifier + diff; schema updates; tamper detection)

Add export-epi to cupola-cli (EPI evidence pack, Day 2)

Add EPI v1 schemas + demo pack (Day 1)

epi-cli: verify EPI zip packs (required files, schema_version, sha256)

Add epi-cli skeleton to workspace (Day 1)

chore: satisfy clippy (search json limit field)

fix: exclude .cupola_app from crawl (stable demo/verify)

cli: demo auto-uses vault-local .cupola_app unless --app-root set

cli: add --app-root portable mode (override %APPDATA%\Cupola)

demo: include resolved search_sample in json summary

cli: add demo proof-loop command

test: cupola-search index persists across reopen

replay: validate manifest CAS blobs exist (no hashing)

cli: add replay validation command with json report