okf: bind trust tiers to current content

[codeyogi911]

Summary

• define a current verification event relative to generated.at
• derive trust tiers only from verification events that apply to current content
• retain the existing behavior when no generation timestamp is declared
• correct two appendix examples whose verification preceded their generation

Why

OKF says generated.at marks the current content's last meaningful change and
allows content to change without re-confirmation. Trust tiers currently derive
from any verified event, so a human check can keep conferring
human-reviewed after the content it checked has changed.

This change preserves earlier verification events as history while preventing
them from confirming later content.

Tests

• cd okf && uv run --python 3.11 --with pytest --with pyyaml python -m pytest -q
• 42 passed

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.