Walk a collected bundle the way the verifier will read it
sando: adopt lint block, fix clippy, fmt
sando: content-addressed release identity; key promote/burn-in on build id