Implement AUDIT-WP-0007 hash-chain integrity.

Accept now extends a single-schema chain. Verify walks it; a rewritten
payload_hash is a break. Tamper evidence is that detector plus an
external chain-head attestation, not WORM.

docs/audit-backend-contract.md

@@ -165,7 +165,7 @@ integrity proofs, or survival of `/tmp` across reboots.
 - `custody_class`: `operational`
 - `retention_days`: unset in production (the service does not expire rows)
 - `immutable`: true (trigger `events_append_only`; not a claim against the database owner)
-- `tamper_evidence`: false (a superuser can drop the trigger; no hash-chain)
+- `tamper_evidence`: true (hash chain + verify + external head attestation; not WORM)
 - `durable`: true
 - `recoverable_days`: 30, cited from the platform `data.backup` provision
 - `recoverable_source`: `resource-control/data/capability/platform-audit-storage.json#provisions[capability=data.backup]`
@@ -240,6 +240,7 @@ Archive remains the evidence record; hot search may use shorter `retention_days`
 
 - `INTENT.md` — product purpose and principles
 - `spec/ProductRequirementsDefinition.md` — full v1 envelope and API requirements
+- `docs/integrity.md` — hash chain, proof bound, verify/attest
 - `registry/capabilities/capability.audit.event-retain.md` — capability registry entry
 ## Secret-shaped fields