Implement AUDIT-WP-0007 hash-chain integrity.

Accept now extends a single-schema chain. Verify walks it; a rewritten
payload_hash is a break. Tamper evidence is that detector plus an
external chain-head attestation, not WORM.

docs/interface-card.yaml

@@ -62,7 +62,7 @@ validation_expectations:
       disposition: unmet requirement recorded on the ITC-CAP case; do not build the sink in AUDIT-WP-0006
     - id: tamper-evidence-false
       owner: audit-core
-      disposition: integrity_verification hook is unknown; trigger is not a proof
+      disposition: closed by AUDIT-WP-0007; proof bound is in docs/integrity.md
     - id: no-hash-chain
       owner: audit-core
       disposition: INTENT residual, not this workplan
@@ -92,7 +92,7 @@ consumer_needs:
   feedback: []
 known_deviations:
   - no data.archive sink
-  - tamper_evidence=False
+  - tamper_evidence is a hash chain plus external head, not WORM
   - no hash-chain
   - single sender user-engine
   - no rapp.yaml (not a rapp-* repo)