Chain the kept evidence, and keep the trust lists it was judged against

Generated with the help of an LLM.

Problem/Motivation

#3634256 keeps the verifier's evidence document as written. The verifier's format document says the document is not signed and that keeping it unaltered is the archive's task. Today the archive does not do that.

• The signed bytes inside a document (certificates, time-stamp tokens, OCSP responses) cannot be changed without breaking their signatures. Everything written around them can: the verdict, the time judged at, the list hashes, and the table's own columns. A changed or deleted record goes unnoticed.
• The document names each trust list only by its SHA-256. The lists live in configuration, which changes, so a verdict cannot be checked again under the list it was judged against.

A hash chain kept in the same database does not stop someone who can rewrite the table from recomputing it. It makes a change visible against a copy of its head kept elsewhere.

Proposed resolution

• Each record stores the SHA-256 of its document, the hash of the record before it, and a hash of its own over its columns. Records are written one at a time under Drupal's lock service; a writer that cannot get its turn keeps no record and logs it, and the suggestion is made all the same.
• Deleting a file erases its records' documents (the certificates that can name a person) and keeps their rows, so the chain has no holes.
• The status report checks the chain without reading documents and names the first record that does not fit. A record's view says whether it fits.
• Each write logs the new head, so a site whose logs leave the server has a copy outside the database.
• Each trust list a kept verdict was judged against is stored once, as given, under its SHA-256, and can be downloaded with the same permission.
• The update chains existing records and says they were chained at update time.

Out of scope: anchoring the head outside the site (for example with a time-stamp), re-verifying records, and keeping the bytes that were read.

Remaining tasks

• Failing tests, then the implementation.
• An ADR for the chain, README and status report text that say what the chain does and does not show.

User interface changes

A status report entry for the chain; the evidence view says whether a record fits; a download link per kept trust list.

API changes

A new route for downloading a kept trust list.

Data model changes

Four new columns on content_credentials_evidence, its document column nullable, and a new table for trust lists. An update hook adds them.