Implement supervised rootless network readiness

crates/lazaret-core/src/network.rs

@@ -275,6 +275,18 @@ pub fn accept_network_readiness(
     })
 }
 
+/// Validates Runtime Supervisor attestation before the sandbox-view probe is available.
+///
+/// # Errors
+/// Returns an error for any identity, observation, policy, or process mismatch.
+pub fn validate_network_attestation(
+    policy: &CanonicalDerivedNetworkPolicy,
+    expectation: &ReadinessExpectation<'_>,
+    attestation: &NetworkReadinessAttestation,
+) -> Result<(), NetworkValidationError> {
+    validate_attestation(policy, expectation, attestation)
+}
+
 /// Revalidates persisted readiness evidence against current generation authority.
 ///
 /// # Errors