Add archival checkpoints and a fail-closed witness seam

Problem/Motivation

Audit Chain currently retains every eligible row because deleting from the one global hash chain would break retained evidence. The existing off-system NDJSON stream is deliberately data-minimized and cannot independently recompute each row hash. Before a later release can define any archival deletion policy, the module needs a stable archival checkpoint and an external-witness contract that do not weaken the chain, seals, successor segments, or retention refusal.

This issue covers the 1.10 hygiene release only. It does not connect to a timestamp authority, OpenTimestamps, Bitcoin, XRPL, or a wallet.

Proposed resolution

• Define a versioned checkpoint digest over a closed global export window: a Merkle root of data-minimized rows, the window chain head, and commitments to existing prefix-seal and successor metadata.
• Document fixed canonicalization and treat any future digest-algorithm change as a contract-version change.
• Add a versioned archive-bundle schema with manifest, Merkle proof material, hashes, and an offline verification recipe. The bundle must exclude metadata, IP addresses, user agents, and entity labels.
• Add a small witness backend interface that accepts only a digest and bounded non-personal context, plus immutable receipt and verdict values.
• Persist receipt placeholders and ship a NoOp backend that remains fail-closed when no live backend is configured.
• Keep witness operations out of the audit chain. They must not call log() or logKeyed().
• Keep prune() as a documented no-op. No archival deletion is enabled by this work.
• Document that a future witness proves existence-before-T of a checkpoint digest, not authorship, legal time by itself, or that the live table is the archive.

Remaining tasks

• Add checkpoint, bundle, witness, schema, and upgrade-path tests.
• Run the kernel suite on SQLite, PostgreSQL, and MySQL.
• Confirm existing mutex, seal, successor, export-checkpoint, retention, and MCP redaction coverage remains green.
• Update README, archival-boundary documentation, and CHANGELOG for 1.10.0.
• Evaluate Drupal 12 honestly against current dependency constraints; do not widen the declared range without a passing CI leg.

User interface changes

None. Configuration may name a future backend, but this issue adds no chain-row viewer, metadata viewer, operational dashboard, or witness dashboard.

API changes

Adds a checkpoint/archive-bundle service and a witness backend interface with submit, upgrade, and verify operations. A backend receives a digest only, never a row, metadata, or channel name.

Data model changes

Adds versioned checkpoint and witness-receipt storage. Existing audit rows, row hashes, prefix seals, successor records, and export checkpoints are not rewritten.