`inno comply` subcommand — GDPR deletion verification, data residue scanning, encryption audit

[ringo380]

Summary

New inno comply subcommand for compliance verification.

CLI Design

inno comply -f <file> --verify-deleted --table users --where "email=john@example.com"
inno comply -f <file> --scan-residue --pattern "john@example\.com"
inno comply -f <file> --encryption-audit
inno comply -f <file> --verify-deleted --table users --where "id=42" --json

Implementation

Module: src/cli/comply.rs (new)

Modes:

• --verify-deleted: Run full deletion verification checklist, report compliance verdict
• --scan-residue: Scan all pages for byte patterns matching regex, report locations
• --encryption-audit: Verify encryption coverage (all pages encrypted, key strength, algorithm)

Output:

• Text: pass/fail checklist with evidence
• JSON: structured ComplianceReport with verdict, checks, evidence
• Exit code: 0 for COMPLIANT, 1 for NON_COMPLIANT, 2 for INCONCLUSIVE

Depends on

#175, #176 (compliance library)

Part of

Epic #165 (GDPR & Compliance Verification)