Add reusable certificate and file validation helpers

Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style.

docs/ci-validation-helpers.md

@@ -55,8 +55,10 @@ NTSTATUS status = DomitoValidateFileObjectEx(
     DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE,
     0,
     DomitoCiSignatureSelectionFirstSuccessfulExperimental,
-    &result);
-if (NT_SUCCESS(status)) {
+    &result
+);
+if (NT_SUCCESS(status))
+{
     // Apply your expected-certificate/trust policy to result.PolicyInfo.
     // result.SigningTime belongs to that selected verification result.
 }
@@ -83,9 +85,9 @@ successful catalog verification.
 
 ```c
 DOMITO_CI_VALIDATION_RESULT result = {0};
-NTSTATUS status = DomitoValidatePortableExecutableEmbeddedSignature(
-    stablePeBytes, peSize, CALG_SHA_256, &result);
-if (NT_SUCCESS(status)) {
+NTSTATUS status = DomitoValidatePortableExecutableEmbeddedSignature(stablePeBytes, peSize, CALG_SHA_256, &result);
+if (NT_SUCCESS(status))
+{
     // Enforce the expected certificate and intended trust policy here.
 }
 DomitoFreeCiValidationResult(&result);