Add reusable certificate and file validation helpers

Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style.

README.md

@@ -38,6 +38,14 @@ algorithm-explicit embedded verification using CI. First-success selection is
 an opt-in x64 experiment; existing APIs retain their behavior. Always enforce
 the expected signer/trust policy separately from a successful CI return status.
 
+## Consumer helpers
+
+[Migration and contracts](docs/consumer-helpers.md) cover file-handle/path CI
+validation, bounded x64 chain views, optional publisher-name extraction,
+certificate/SPKI hashing (including explicit legacy content-only pins), strict
+hex conversion, process-name cleanup and combined module/export lookup.
+Application authorization and trust policies remain caller-provided.
+
 ## How to use
 
 - Add the `include` directory to your project's headers search path.
@@ -63,7 +71,11 @@ the expected signer/trust policy separately from a successful CI return status.
 
 ### Using the property sheet
 
-Copy the provided `Domito.props` file into the directory of your `.vcxproj` file and customize it like below:
+Import `Domito.props` from the Domito package, or set `DomitoRootPath` explicitly
+if copying the sheet elsewhere. Its default root is its own directory. The sheet
+links both WDM and KMDF final drivers; static-library consumers must also import
+it into the final driver project. `DomitoLibraryPlatform` defaults to `$(Platform)`.
+For example:
 
 ```xml
   <!-- The rest of the project file -->