Add the audit chain verifier

Implemented proto::ChainVerifier as a pure line-holding state machine:
each line is judged only once the next has arrived, so a Recovery record
can mark the line before it not-a-record. Adds ChainFailure, TornTail,
ChainReport, Location and ChainVerifier, wired through lib.rs and the
matching re-export in audit.rs. 13 chain tests pass; make gate prints
gate: ok.

Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)

crates/proto/src/audit.rs

@@ -4,6 +4,8 @@ use serde::{Deserialize, Serialize};
 
 use crate::{CallId, DataClass, DenyReason, Hash32, SessionId, Timestamp};
 
+pub use crate::chain::{ChainFailure, ChainReport, ChainVerifier, Location, TornTail};
+
 // JSON: {"outcome":"denied","reason":"no_grant"} ; the tag sits beside the fields
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(tag = "outcome", rename_all = "snake_case", deny_unknown_fields)]