Add reusable certificate and file validation helpers

Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style.

docs/implementation-status.md

@@ -102,7 +102,26 @@ and compilation do not close the remaining work:
 
 ## Checks
 
-Run the four host runners in `tests/README.md`. Kernel compilation also covers
+Run the six host runners in `tests/README.md`. Kernel compilation also covers
 the default modern x64/ARM64 structures, the pre-Windows-10 x64 compile variant,
 and 14 assertions in the 26100 opt-in header plus 12 historical-view assertions. Those are build checks,
 not a claim that historical or ARM64 CI runtime ABI has been verified.
+
+## Consumer-driven helpers
+
+The [consumer migration review](consumer-helpers.md) separates verified defects,
+existing corrections, new helpers and downstream policy. Additions include
+handle/path native CI wrappers, explicit SPKI representation/hash helpers,
+strict hex conversion, an explicit-layout x64 chain view, optional publisher
+resolution with matching cleanup, a referenced-process name API and dedicated
+process-name cleanup. The PID path fixes dangling failure output and excessive
+process access; module-base lookup clears stale output. WDM/KMDF linking is
+covered by the package-relative property sheet. No default publisher/root trust
+policy, automatic legacy fallback, or process authorization/cache is introduced.
+
+Four compatibility functions carry MSVC deprecation annotations with explicit
+migration messages: heuristic digest-kind discovery, compatibility PE hashing,
+implicit-policy legacy validation and PID-based process-name lookup. Native CI
+types/functions remain available for low-level callers. The compile-only
+deprecation suite checks actual public headers in C/C++, including modern API
+controls and expected C4996 diagnostics for each older entry point.