commit-graph: verify contents match checksum