Document CI validation flag 0x20 and add kernel probe

tests/ci-file-object-probe.h

@@ -0,0 +1,29 @@
+#pragma once
+
+// Include ntifs.h and Domito.MinCrypt.h first. Test support, not a library API.
+typedef struct _DOMITO_CI_PROBE_RESULT
+{
+    ULONG Flags;
+    ULONG InputCapacity;
+    NTSTATUS Status;
+    UINT32 HashSize;
+    ALG_ID HashAlgId;
+    UCHAR Hash[MINCRYPT_MAX_HASH_LENGTH];
+    LARGE_INTEGER SigningTime;
+    ULONG PolicyBits;
+    ULONG TimeStampPolicyBits;
+    NTSTATUS VerificationStatus;
+    NTSTATUS TimeStampVerificationStatus;
+    BOOLEAN HasChain;
+    BOOLEAN HasTimeStampChain;
+    BOOLEAN HashGuardIntact;
+} DOMITO_CI_PROBE_RESULT;
+
+#define DOMITO_CI_PROBE_RESULT_COUNT 6
+
+// PASSIVE_LEVEL; referenced file object; file bytes must remain stable.
+// Writes observations, not an overall trust verdict. Frees both policies per call.
+_IRQL_requires_max_(PASSIVE_LEVEL)
+void DomitoProbeCiValidateFileObject(
+    _In_ PFILE_OBJECT FileObject,
+    _Out_writes_(DOMITO_CI_PROBE_RESULT_COUNT) DOMITO_CI_PROBE_RESULT* Results);