cert: a certificate is a record, not a capability

`QuorumCert` has public fields and `verify` counts against the `threshold`
written on the certificate, so `verify` alone clears a 1-of-7 certificate
that says `threshold: 1`. The doc explained that and then explained the
remedy, but never stated the invariant the two hang off — and a reader who
skims to "every signature verified" has everything they need to mistake it
for acceptance.

So state it first: holding a certificate authorises nothing, because anyone
can build one saying anything. What authorises is `verify_weighted`, every
acceptor runs it, and the count-only predicate is the structural pre-filter
inside it. Nothing about the code changes; the sentence a reader needs first
is now first.

Co-authored-by: Hanzo Dev <[email protected]>

pkg/rust/src/cert.rs

@@ -313,7 +313,13 @@ impl QuorumCert {
     /// The count-only predicate: every structural clause, plus a valid signature
     /// from each of at least `threshold` distinct voters.
     ///
-    /// This is NOT a standalone accept rule, and must not be used as one. The
+    /// A CERTIFICATE IS A RECORD, NOT A CAPABILITY. Every field on it is public
+    /// and anyone may build one that says anything; holding one authorises
+    /// nothing. What authorises is [`Self::verify_weighted`], and EVERY acceptor
+    /// runs it — this, the count-only predicate, is the structural pre-filter
+    /// inside it.
+    ///
+    /// So it is NOT a standalone accept rule, and must not be used as one. The
     /// `threshold` it counts against is a field of the certificate — the
     /// certificate names its own quorum — so on its own this clears a 1-of-n
     /// certificate that declares `threshold: 1`. It is a building block: