Add dispute example bundle: end-to-end billing dispute proof

examples/dispute/ contains a complete scenario:
- raw_events.json: 5 synthetic AI usage events (Acme Corp, 37,500 requests)
- evidence.json: sealed evidence pack (schema 0.2.0, key_id dispute-demo-2026-q2)
- evidence_tampered.json: same pack with event[1].quantity changed (4100 -> 2900)
- verify_valid.txt: exact output of usageguard verify on intact pack
- verify_tampered.txt: exact output on tampered pack (Event 1: leaf hash mismatch)
- README.md: scenario, file descriptions, try-it commands, authority note

No new CLI commands. No runtime changes.

4 regression tests:
- bundled valid evidence verifies
- bundled tampered evidence fails on event 1
- raw event count matches sealed event count
- tampered event has different quantity, others unchanged

80 Rust + 16 Python = 96 tests green.

Author: Doug Hamaker

Cargo.lock

@@ -0,0 +1,59 @@
+# Dispute Example
+
+A complete end-to-end example of how UsageGuard is used when a customer questions a usage invoice.
+
+## Scenario
+
+You bill Acme Corp for 37,500 API requests in the week of April 7-9, 2026:
+- 10,100 GPT-4o completion requests
+- 27,400 embedding requests
+
+Acme disputes: "That seems high. How do we know those numbers weren't changed?"
+
+You send them the evidence pack and your public key.
+
+## Files
+
+| File | What it is |
+|------|-----------|
+| `raw_events.json` | The 5 usage events as recorded by your system |
+| `evidence.json` | Sealed evidence pack (Merkle tree + ed25519 signature) |
+| `evidence_tampered.json` | Same pack with event[1] quantity changed from 4100 to 2900 |
+| `verify_valid.txt` | Output of `usageguard verify evidence.json` |
+| `verify_tampered.txt` | Output of `usageguard verify evidence_tampered.json` |
+
+## Try it yourself
+
+```bash
+# Verify the valid evidence pack
+usageguard verify evidence.json
+# Output: VERIFIED — 5 events, intact
+
+# Verify the tampered evidence pack
+usageguard verify evidence_tampered.json
+# Output: FAILED — Event 1: leaf hash mismatch
+
+# Optionally inspect how events were normalized (not authoritative)
+usageguard explain evidence.json
+usageguard explain evidence.json --event-index 1 --verbose
+```
+
+## What happened in the tampered version
+
+`evidence_tampered.json` is identical to `evidence.json` except `events[1].quantity` was changed from `4100.0` to `2900.0`. That single field change causes the leaf hash for event 1 to no longer match the Merkle proof, and `verify` reports the failure.
+
+## Authority
+
+Only `verify` determines whether the evidence pack is intact. `explain` is an inspection tool that helps humans read provenance and Merkle proofs — it is not the proof itself.
+
+If `verify` passes, the evidence pack is intact and matches the signed usage record.
+
+## Public key for this example
+
+```
+2e930834ff9b43c01a897bd0dffa01bd0870505633b09615d0a532103ea472ee
+```
+
+Key ID: `dispute-demo-2026-q2`
+
+In production, the vendor publishes their public key separately (website, documentation, or direct exchange). The key inside the evidence pack is what was used to sign — you compare it against the key the vendor gave you.