feat(verify): tamper-evident evidence hash chain

[BoozeLee]

What this PR adds

A deterministic SHA-256 chain over the evidence directory. Two new fields land on every evidence/<task>.json at write time:

{
  "task": "…",
  "goal": "…",
  "verdict": "PASS",
  "results": [ … ],
  "prev_hash": "abc…  (sha256 of the most recent prior record, or 64 zeros)",
  "hash":      "def…  (sha256 of the canonicalised record, excluding time+hash)"
}

The chain is reproducible, append-only in spirit, and stands up to silent edits: any past edit that does not also re-write all downstream records breaks at the next prev_hash link.

Why it crosses the bar

This is the substrate that turns evidence into an externally-verifiable, tamper-evident log without introducing any new dependency (only stdlib's hashlib and json) and without changing any external schema. Once it lands:

• repotruth can audit evidence integrity by recomputing the chain.
• mcp-regression-lab can replay only records whose chain is intact.
• terminal221b can sign approvals as approval_for: evidence_hash.
• Quattro-Commas.github.io can render the chain head as a public heartbeat.

Today every other audit tool in the org has to trust harness's evidence directory. After this lands they re-derive the chain themselves.

Files

File	Δ	Purpose
harness/chain.py (new)	+56	evidence_hash(ev) -> str (SHA-256, stdlib only) and prev_evidence_hash(root) -> str (most-recent record by time, falling back to mtime, then 64-zero sentinel). Total contract — never raises.
harness/verify.py	+4 lines	cmd_verify writes prev_hash / hash immediately before write_evidence.
harness/runner.py	+4 lines	Same wiring in _verify_run for parity with harness serve.
tests/test_chain.py (new)	+123 lines	14 tests pinning: shape, determinism, sort-keys invariance, time-exclusion, chain advancement, parseable-record selection, mtime fallback, silent historical edit detection, middle insertion detection.

Tests

uv run pytest -q tests/test_chain.py   →   14 passed
uv run pytest -q (full suite)          →   103 passed
uv run ruff check harness/ tests/...   →   clean
uv run mypy harness/                   →   no issues

Behaviour change

evidence/*.json files gain two top-level fields (prev_hash, hash). Existing readers ignore unknown keys — no schema bump. The hash itself is stable across runs of the same evidence: same canonical form, same SHA-256.

Out of scope (later phases)

• repotruth audit-evidence <file> to validate a single record's chain membership.
• A public chain-head heartbeat on the org website.
• Embedding the chain head into the repro block (independent dimension of reproducibility).
• Cryptographic signature over the chain head (deliberately not done — the SHA-256 chain gives the same audit invariant without bringing in GPG/age/nacl as a new silo).

Acceptance

A reviewer can run:

cd /path/to/repo && for f in .ai-engineering/evidence/*.json; do
  python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); print(d.get("hash","MISSING"))' "$f"
done

…and verify that hash == sha256(canonical(record without time|hash)) for every file, and that prev_hash of record N equals hash of the most recent record at the time N was written. The hash chain itself is inspectable from git alone; no external tooling is required.