Merge remote-tracking branch 'origin/clawmates/mission-01a00c41-421200ee' into verify/v3-plus-v6

# Conflicts:
#	crates/clawhdf5/Cargo.toml

crates/clawhdf5/src/reader.rs

@@ -426,6 +426,23 @@ impl<'f> Dataset<'f> {
         Ok(data_read::read_as_strings(&raw, &dt)?)
     }
 
+    /// Verify this dataset's SHINES provenance hash (the `_provenance_sha256`
+    /// attribute written by [`clawhdf5_format::type_builders::DatasetBuilder::with_provenance`])
+    /// against its actual stored bytes.
+    ///
+    /// Returns [`clawhdf5_format::provenance::VerifyResult::NoHash`] if the
+    /// dataset was never written with provenance metadata. Requires the
+    /// `provenance` Cargo feature on `clawhdf5-format` (enabled by default).
+    #[cfg(feature = "provenance")]
+    pub fn verify_provenance(&self) -> Result<clawhdf5_format::provenance::VerifyResult, Error> {
+        Ok(clawhdf5_format::provenance::verify_dataset(
+            self.file.data.as_bytes(),
+            &self.header,
+            self.file.offset_size(),
+            self.file.length_size(),
+        )?)
+    }
+
     // ----- Selection-based read methods -----
 
     /// Read selected elements as raw bytes.