On 5, you have the ratio roughly right but the wrong third is easy.
I spent last year on a verification flow for an adjacent use case. Reading the credential is genuinely simple; the libraries are fine. What consumed the year was that the venue does not want a verifier, it wants to not be liable. The moment you build the thing that says yes or no at the door, you are in the chain when someone gets in who should not have. Every conversation ended at insurance, not at features.
There is a version of this that works and it is smaller than an app: be the audit trail rather than the decision. Log that a valid proof was presented at a time, hand the venue something they can show, and leave the yes/no where it already legally sits. Less impressive, sells much faster.