Check that an issuer's home_domain round-trips to the same stellar.toml

Written to the standard set by #33 — read that issue first for the expected level of detail and the acceptance criteria every check shares. ## What Check that an asset's issuer account declares a `home_domain`, and that the `stellar.toml` at that domain lists the same asset back. ## Why it matters Right now `asset.HomeDomain` is a hardcoded registry of associations this project verified by hand. That does not scale past a handful of issuers, and it cannot detect an issuer that later points its `home_domain` somewhere else. The round trip is what makes an asset↔anchor claim self-verifying: the account names a domain, and the document at that domain names the account back. An asset failing this is claiming an association the other side does not confirm. ## Which layer **Layer 1 — observable fact.** Two reads, both from primary sources. No inference. ## Exactly where the code goes - **New file:** `checks/toml_home_domain_roundtrip.go` - Tests appended to `checks/checks_test.go` - Register in `Runner.Default()` in `checks/runner.go` - Read `checks/issuer_auth_flags.go` (Horizon read) and `checks/toml_anchor_asset.go` (TOML read) — this check combines both shapes ## Where the data comes from 1. `GET /accounts/{issuer}` → `home_domain` — https://developers.stellar.org/docs/data/apis/horizon/api-reference/resources/accounts 2. `https://{home_domain}/.well-known/stellar.toml` → `[[CURRENCIES]]` — use `anchor.Resolver`, which already handles the fetch and the salvage path for malformed documents ## What "unmeasurable" means here - Account has **no** `home_domain` → UNABLE-TO-DETERMINE. Declaring nothing is not the same as declaring something wrong - The domain does not resolve, or the TOML cannot be fetched → UNABLE-TO-DETERMINE, naming the failure - TOML fetched but lists **no matching** `[[CURRENCIES]]` entry → **determined failure**. Both sides were asked and they disagree ## Acceptance criteria - [ ] Implements the Check contract in docs/checks.md - [ ] Returns UNABLE-TO-DETERMINE (not zero, not a default) when data is unavailable - [ ] Records evidence naming both the account and the document - [ ] Network I/O through the http.RoundTripper seam; uses `Runner.client()` so it inherits the SSRF guard - [ ] Table tests from recorded bytes; no live network - [ ] Negative test: a domain whose TOML does not list the asset - [ ] No new third-party dependencies - [ ] gofmt, vet, test -race, golangci-lint clean - [ ] Does not change the headline integrity state or verdict thresholds - [ ] Matches on code **and** issuer — an entry matching code alone proves nothing ## Out of scope `asset.HomeDomain` stays as it is; this check does not replace the registry yet. Nothing in `route/`, `dex/`, `sep38/`, or `runstore/runstore.go`. ## How to verify locally ```bash make offline-test go test ./checks/ -run TestHomeDomain -v ``` Then break it deliberately and confirm the negative test fails.