pub fn verify_all_with_kernel() -> Result<usize, String>
Check every rule’s certificate through the kernel. Returns the number of verified rules; the first failure aborts with the rule’s name.