Add reusable certificate and file validation helpers

Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style.

tests/run-digest-tests.py

@@ -4,31 +4,54 @@ Extracts the actual production functions without changing their bodies, replacin
 only kernel dependencies with the test harness. No driver is loaded. This tests
 parsing, hashing and cleanup, not real CI policy or kernel I/O synchronization.
 """
+
 import argparse
 from pathlib import Path
 import subprocess
 import tempfile
 
 parser = argparse.ArgumentParser()
-parser.add_argument('--source-root', type=Path, default=Path(__file__).resolve().parents[1])
-parser.add_argument('--digest-source', type=Path)
+parser.add_argument("--source-root", type=Path, default=Path(__file__).resolve().parents[1])
+parser.add_argument("--digest-source", type=Path)
 args = parser.parse_args()
 root = args.source_root
-digest = (args.digest_source or root / 'src/Domito.CodeIntegrity.cpp').read_text(encoding='utf-8-sig')
-digest = digest.replace('#include "Domito.Internal.h"', '').replace('#include "Domito.MinCrypt.h"', '')
-common = (root / 'src/Domito.cpp').read_text(encoding='utf-8-sig')
-start = common.rfind('_Success_', 0, common.index('DomitoMemorySearchPattern('))
-end = common.index('_Success_', common.index('DomitoMemorySearchPattern('))
+digest = (args.digest_source or root / "src/Domito.CodeIntegrity.cpp").read_text(
+    encoding="utf-8-sig"
+)
+digest = digest.replace('#include "Domito.Internal.h"', "").replace(
+    '#include "Domito.MinCrypt.h"', ""
+)
+common = (root / "src/Domito.cpp").read_text(encoding="utf-8-sig")
+start = common.rfind("_Success_", 0, common.index("DomitoMemorySearchPattern("))
+end = common.index("_Success_", common.index("DomitoMemorySearchPattern("))
 search = common[start:end]
-public = (root / 'include/Domito.h').read_text(encoding='utf-8-sig')
-start = public.index('#if !defined(CALG_SHA1)')
-end = public.index('/*', public.index('DOMITO_CALG_TO_BCRYPT_ALGORITHM('))
+public = (root / "include/Domito.h").read_text(encoding="utf-8-sig")
+start = public.index("#if !defined(CALG_SHA1)")
+end = public.index("/*", public.index("DOMITO_CALG_TO_BCRYPT_ALGORITHM("))
 algorithm = public[start:end]
-with tempfile.TemporaryDirectory(prefix='domito-digest-tests-') as temp:
+with tempfile.TemporaryDirectory(prefix="domito-digest-tests-") as temp:
     build = Path(temp)
-    (build / 'digest-under-test.inc').write_text(algorithm + '\n' + search + '\n' + digest, encoding='utf-8')
-    test_source = Path(__file__).with_name('digest-tests.cpp')
-    subprocess.run(['cl', '/nologo', '/EHsc', '/W4', '/WX', '/std:c++17',
-                    '/I' + str(build), str(test_source), '/Fe' + str(build/'digest-tests.exe'),
-                    '/Fo' + str(build/'digest-tests.obj'), '/link', 'bcrypt.lib', 'crypt32.lib'], cwd=build, check=True)
-    subprocess.run([str(build/'digest-tests.exe')], cwd=build, check=True)
+    (build / "digest-under-test.inc").write_text(
+        algorithm + "\n" + search + "\n" + digest, encoding="utf-8"
+    )
+    test_source = Path(__file__).with_name("digest-tests.cpp")
+    subprocess.run(
+        [
+            "cl",
+            "/nologo",
+            "/EHsc",
+            "/W4",
+            "/WX",
+            "/std:c++17",
+            "/I" + str(build),
+            str(test_source),
+            "/Fe" + str(build / "digest-tests.exe"),
+            "/Fo" + str(build / "digest-tests.obj"),
+            "/link",
+            "bcrypt.lib",
+            "crypt32.lib",
+        ],
+        cwd=build,
+        check=True,
+    )
+    subprocess.run([str(build / "digest-tests.exe")], cwd=build, check=True)