Verifying an on-device agent's audit chain off-device: the CI replay

The agent emits a hash-chained, Secure-Enclave-signed audit log. The CI-side verification protocol and Swift CLI for regulators and incident responders.