Summary

Closes #6449

The base transcript-integrity feature (#6360, PR #6453) shipped hash-chain
tamper-evidence for subagent transcripts, session logs, and the durable
journal, but explicitly deferred defense against a fully-consistent
whole-file/whole-execution downgrade: an attacker who deletes every chain
field from a JSONL file (or the durable integrity row entirely) makes
tampered content indistinguishable from genuine pre-feature legacy content,
which is auto-trusted by design.

This PR closes that gap:

• JSONL (subagent transcript, session log): a per-file vault anchor
  {epoch, count, head, written_at} is written to the age vault on finalize
  and checked on read. Since the vault cannot be selectively edited without
  the age key, a whole-file strip now produces a detectable mismatch. A
  bounded reconcile-and-cap sweep reaps orphaned anchors and caps vault
  growth via LRU eviction keyed on the anchor's own embedded write
  timestamp (not filesystem mtime, which is attacker-writable).
• Durable: replaces the "missing integrity row is legacy" assumption
  with an operator-gated vault seal (zeph durable seal-integrity). Once
  sealed, an absent integrity row on a keyed, drained execution is
  unconditional tamper. The seal boundary is entirely vault-resolved — no
  attacker-writable database column participates in the tamper decision.
• New [integrity] config section, zeph sessions verify CLI, doctor/
  --init/--migrate-config/TUI integration.
• Documented residuals rather than silent gaps: session-prefix rollback
  (unanchored tail truncation), grandfather opt-out (permanent forgeable
  slot by design), reconcile-window recreation (bounded, requires a
  destructive precursor).

Design process

Went through 2 architecture revisions and 2 rounds of adversarial critique
before implementation:

• Rev1 proposed a durable created_at-based floor; critic found it was
  defeated by the same DB-write threat model it targeted (the comparison
  column was unauthenticated and attacker-writable).
• Rev2 replaced it with a pure vault-presence seal marker plus a
  drain-before-seal precondition — critic confirmed this closed the gap,
  but found the session-anchor LRU eviction picked victims by attacker-
  writable filesystem mtime (same flaw class). Fixed to evict by an
  AEAD-protected embedded timestamp instead.

Implementation was independently validated by parallel test/perf/security/
critic passes, which surfaced and fixed: an insta snapshot regression, a
non-functional read-timeout (the tokio::time::timeout wrapped an
already-resolved future), a vault write-lock held across synchronous
filesystem stats, an inaccurately-documented reconcile-reap residual, and a
dropped NFR-005 audit-event requirement. Final review required two more
rebases as origin/main advanced during the cycle (#6455, #6457, #6460),
including a careful reconciliation in zeph-durable's local.rs to confirm
a concurrently-merged HMAC-rotation feature did not reintroduce a
database-derived value onto the tamper-decision boundary.

Test plan

• Full CI-matching suite green: fmt --check, clippy --profile ci
  (full feature set), rustdoc gate, cargo test --doc
• cargo nextest run — 14607 passed, 0 failed, 35 skipped
• gitleaks protect --staged — clean
• Whole-strip of an anchored transcript/session → TAMPER; pre-anchor
  chained file (no anchor) → still opens (no migration break)
• Durable: forged created_at + deleted integrity row on a post-seal
  keyed execution → still TAMPER (proves no DB column on the boundary)
• Session-anchor eviction order proven to follow the embedded
  written_at, not filesystem mtime, under deliberately conflicting
  test setup
• Read-timeout regression tests using genuine background-thread lock
  contention (not mocked) for both the async and sync anchor-lookup
  paths
• Testing playbook and coverage-status updated (main repo
  .local/testing/)