Command devproof builds, verifies, and expands immutable bundles.
It is a thin adapter over the Go SDK: every command maps to one public SDK
operation, so anything the CLI can do is reachable from an embedding
application without shelling out (DP-001).