Add VERIFY_CHECK and use CHECK macros more

Add a new macro VERIFY_CHECK (which only performs CHECK() when -DVERIFY is set), and move those macros to util.h.

All internal asserts are converted to VERIFY_CHECKs, all external input checks are converted to CHECKs.