docs: caveat that the meta-null verify form corrupts header hashing

Author: fiskus

docs/verification.md

@@ -41,6 +41,8 @@ split -l 1 ~/MANIFEST.jsonl \
   tr -d '\n' | sha256sum
 ```
 
+**Caveat**: Use this meta-null form only when rows actually carry `"meta": null` — applied to a header line (which has no `meta`), `jq` reads the absent `.meta` as null and injects `meta: {}`, corrupting the header hash; use the plain `del(.physical_keys)` form otherwise.
+
 ## CRC64/NVMe Verification
 
 CRC64-NVMe is a whole-file checksum (no chunking). The digest is 8 bytes,