docs: add normative verifier obligation for checkout_hash

[chopmob-cloud]

Summary

The checkout_hash field definition in checkout_mandate.md specifies what
the field IS (base64url SHA-256 of checkout_jwt) but contains no normative
obligation telling verifiers they MUST check it.

This adds a MUST/MUST NOT gate immediately after the field description:

Before releasing credentials or initiating payment, the Credential Provider,
Merchant, and Merchant Payment Processor each MUST independently recompute
checkout_hash by applying the _sd_alg algorithm (or sha-256 if absent)
to the raw bytes of the checkout_jwt value and comparing the result to the
checkout_hash field. If the values do not match, the verifier MUST reject
the mandate and MUST NOT proceed with the transaction.

Motivation

Without this text, a conformant implementation can accept a Checkout Mandate
where checkout_jwt has been substituted (e.g. amount altered) while
checkout_hash still matches the original. The field provides no security
guarantee until checking it is normatively required.

This follows the pattern already established in the payment.reference
constraint evaluation ("MUST contain an open Checkout Mandate with a matching
hash") — the same MUST language applied to the Checkout Mandate's internal
integrity gate.

Related: issue #211 (cart-to-payment binding discussion).

[gemini-code-assist]

Code Review

This pull request updates the documentation for the Checkout Mandate to include a mandatory verification step for the checkout_hash. The reviewer suggested rephrasing the new requirement for improved readability and clarity, which has been accepted as a valid improvement opportunity.

[gemini-code-assist]

For improved readability, consider rephrasing this paragraph to more clearly separate the primary requirement from the implementation details. Breaking the first long sentence into two can make the instruction easier to parse.

Suggested change

	Before releasing credentials or initiating payment, the Credential Provider,
	Merchant, and Merchant Payment Processor each MUST independently recompute
	`checkout_hash` by applying the `_sd_alg` algorithm (or `sha-256` if absent)
	to the raw bytes of the `checkout_jwt` value and comparing the result to the
	`checkout_hash` field. If the values do not match, the verifier MUST reject
	the mandate and MUST NOT proceed with the transaction.
	Before releasing credentials or initiating payment, the Credential Provider,
	Merchant, and Merchant Payment Processor each MUST verify that the `checkout_hash`
	field's value matches a computed hash of the `checkout_jwt` value. The hash
	MUST be computed by applying the `_sd_alg` algorithm (or `sha-256` if absent)
	to the raw bytes of the `checkout_jwt` value. If the values do not match, the
	verifier MUST reject the mandate and MUST NOT proceed with the transaction.

[chopmob-cloud]

Thanks for the suggestion @gemini-code-assist — applied in the latest commit. The paragraph now opens with the primary obligation ("verify that the checkout_hash field's value matches a computed hash") before introducing the implementation detail (how to compute the hash), which makes the intent clear on first read.

[gemini-code-assist]

That sounds great. Thank you for confirming the update, and I'm glad the phrasing now clearly emphasizes the normative obligation for verifiers.