If the homomorphic evaluation procedure is deterministic, as is usually the case, the program integrity requirement is trivially fulfilled: given a function $f$, the input ciphertext $C$ and the output ciphertext $C'$, anyone can publicly evaluate $f$ on $C$ (homomorphically) and check that the result is indeed $C'$. However, this conflicts with a standard other requirement, where one wants the output $C'$ to be distributed as an encryption with uniformly random coins.
When the output ciphertext is randomized, to ensure program integrity, the usual strategy is to use a zero-knowledge proof system. Namely, given a function $f$, the input ciphertext $C$ and the output ciphertext $C'$, the homomorphic evaluator will prove in zero-knowledge that $C'$ was obtained as the result of homomorphically evaluating $f$ on $C$ (and randomizing the output). Many solutions exist to implement this, depending on the other constraints (e.g. if we want this verification to be less expensive than performing the entire homomorphic evaluation, on can use succinct zero-knowledge proofs).
Regarding your 'program obfuscation' requirement, this sounds like what is usually called circuit privacy (i.e., when evaluating $f$ on $C$ homomorphically and getting an output $C'$, seeing $(C,C')$ should leak nothing about $f$). Any 'partially homomorphic' encryption scheme we know of (Paillier, ElGamal, Goldwasser-Micali, and the like) is re-randomizable (given a ciphertext $C$, anyone can publicly construct a ciphertext $C'$ encrypting the same value with uniformly distributed random coins), hence can be trivially made circuit-private. For fully homomorphic encryption, it's a bit more complex, but there are also well-established techniques, such as using noise flooding, or some more advanced strategies such as this one.