System design for a local image examiner that still works after C2PA is stripped: twelve witnesses, one written fusion policy, and a list of ways it can be wrong