verify_signature(
db_path,trusted_pubkey) ->ok,err,pubkey
Verify the Ed25519 signature of a .lilpack file
Opens the MNEME database at db_path, recomputes the canonical digest,
and verifies the embedded Ed25519 signature. If trusted_pubkey is
provided, the signature is verified against it; otherwise falls back to
the default trusted key (from LILPACK_PUB_KEY env or built-in).
Returns true, nil, pubkey on success, or nil, error_message on failure.