Summary

Extend the advisory scripts/verify.sh umbrella (#1124 / #1127, then #1134) with a 5th
sub-check, [5/5] reseal-prev, that ties the NMSE seal state to the CURRENT PR DIFF, and
update the make help text. Advisory only -- always exits 0, never reseals, never blocks.

Motivation

Sub-check [1/5] already reports the ABSOLUTE seal state (fresh / stale / unsealed), but on
its own that is noisy: the seal is frequently stale on master for reasons unrelated to a
given PR, so a contributor cannot tell whether THEIR change needs a reseal. The only question
that actually matters before a push is: "does this PR touch the sealed compiler, and if so,
is the seal current?"

[5/5] answers exactly that by combining [1/5]'s seal verdict with a diff of the PR:

• diff does NOT touch bootstrap/src/compiler.rs -> seal state is irrelevant to this PR; any
  pre-existing staleness is unrelated. Reports OK.
• diff DOES touch compiler.rs AND the seal is fresh -> OK.
• diff DOES touch compiler.rs AND the seal is stale/unsealed -> prints a REMINDER: IF the
  edit changed numerics, reseal explicitly (make seal); IF it did not (an allow(), a
  comment, a test), the existing seal state is fine. It is explicitly a reminder, NOT a
  verdict on whether the edit is numeric -- the script never inspects semantics.

Guarantees (consistent with #1127 / #1134)

• Always exits 0. It is a preview/reminder, not a gate; the four required CI checks
  remain the real gate.
• Best-effort: reuses [1/5]'s seal exit code and diffs the local base ref
  (origin/master, falling back to master); only as fresh as the last git fetch.
• Skips automatically outside a git work tree or when no base ref is found.
• VERIFY_SKIP_RESEAL=1 disables just this sub-check; the other skip flags
  (VERIFY_SKIP_TEST, VERIFY_SKIP_GATES) are unchanged.

Files

• scripts/verify.sh: add [5/5] reseal-prev, renumber [1/4..4/4] -> [1/5..4/5], refresh
  the header sub-check list and usage block.
• Makefile: update make help to mention reseal-preview and the VERIFY_SKIP_RESEAL flag.

Verification

• bash -n scripts/verify.sh clean; make verify runs all 5 sub-checks and exits 0.
• On a clean tree [5/5] reports OK (compiler.rs not in diff).
• With a committed compiler.rs edit and a stale seal, [5/5] prints the REMINDER and
  still exits 0.
• VERIFY_SKIP_RESEAL=1 correctly skips [5/5].

L6 gf16 SSOT untouched; catalog stays 83; no gen/ edits; ASCII-only added lines; no quality
claim added.