fix(P10): audit log tamper-evidence (REQ-125, F2)

---ci---
project: orca
phase: 10
milestone: v0.12
status: execute
---/ci---

Migration 0008: add prev_hash + entry_hash columns + append-only
triggers (UPDATE/DELETE blocked with ABORT).
audit_repo.go: Append computes hash chain (sha256(prev_hash ||
timestamp || actor || action || resource || result || error ||
metadata)). VerifyChain recomputes from first entry, detects
tampering.
2 new tests: VerifyChain (5-entry chain verifies), TamperDetection
(UPDATE + DELETE blocked by trigger). All store tests pass.

internal/store/migrate_test.go

@@ -19,8 +19,8 @@ func TestMigrationVersion(t *testing.T) {
 	if err != nil {
 		t.Fatalf("migration version: %v", err)
 	}
-	if version != "0007_certs_serial_unique.sql" {
-		t.Errorf("MigrationVersion = %q, want 0007_certs_serial_unique.sql", version)
+	if version != "0008_audit_tamper_evidence.sql" {
+		t.Errorf("MigrationVersion = %q, want 0008_audit_tamper_evidence.sql", version)
 	}
 
 	// Empty the migrations table → should return ("", nil).