Validate a CUSIP (9-character US/Canada securities identifier) with its mod-10 weighted check digit. Returns {valid, cusip, checkDigit, reason}. Catches transposed characters in security master / holdings data that a length check misses. Structure + checksum only.