Add CI validation helpers with explicit signature selection and owned results

docs/mincrypt-contracts.md

@@ -158,6 +158,10 @@ later conversion failure. It is not owned by either policy object.
 Evidence: `MincryptFreePolicyInfo`, `MincryptCopyPolicyInfo`,
 `I_MincryptAddChainInfo`, `CiVerifyHashInCatalog`, and `CiGetCertPublisherName`.
 
+The additive [validation helpers](ci-validation-helpers.md) package safe result
+ownership, explicit file-object selection and embedded CI verification. They do
+not change raw CI declarations or existing legacy-helper behavior.
+
 ## Multiple signatures and selected results
 
 `CiValidateFileObject` returns one selected signature result and its timestamp