feat(audit): write content-addressed hash tiles beside the sealed segments

[chernistry]

Sealing an audit segment produced the segment and the seal, and nothing a third party could check a single segment against without replaying the whole chain.

This writes a hash tile next to each segment at seal time — a small deterministic record naming the segment and its digest — so one segment can be verified on its own.

Deterministic in the sense that matters here: the same segment and seal produce a byte-identical tile, so two operators sealing the same chain get the same tiles and a diff between them is a real divergence rather than a timestamp.

tiles.py also gains the read side (list_hash_tiles, has_hash_tile, read_hash_tile, tile_hash_path), and audit seal reports how many tiles it wrote.

21 tests cover generation, determinism, the path layout, and the read helpers. Full suite green locally apart from test_guardrails_no_relax_outside_sandbox, which fails on untouched main inside a container and is fixed by #4626.

Closes #3829

[github-actions]

Context-file staleness report

Checked 7 curated context file(s) at 573df3f73a52. 6 flagged.
Baseline 5dbdc1a5d3ae: 1 newly flagged since.

src/bernstein/adapters/AGENTS.md (newly flagged in this range)

• Scope: src/bernstein/adapters/
• Last touched: 34090c678fb6 (2026-08-24T19:45:14Z) — docs: reset staleness clock for curated context files (context-file staleness: curated context files lag their subtrees #4442) (docs: reset staleness clock for curated context files (#4442) #4477)
• Since then: 4 commit(s) in scope; net diff 6 file(s), +258/-30 (288 lines, threshold 200)
• Modules added: src/bernstein/adapters/goose_stream_parser.py
• Top commits by churn:

Commit	Lines	Subject
464f65e9715e	209	feat(adapters): drive more of the goose CLI and parse its stream (#4616)
eae6e064c67c	46	docs: regenerate adapter last-green table from canary receipts (#4584)
6193aa0358ad	42	docs: regenerate adapter last-green table from canary receipts (#4494)
247b83dd40cd	33	fix(#4571): agent timeout extension reaches the spawned process (#4608)

src/bernstein/cli/AGENTS.md

• Scope: src/bernstein/cli/
• Last touched: 34090c678fb6 (2026-08-24T19:45:14Z) — docs: reset staleness clock for curated context files (context-file staleness: curated context files lag their subtrees #4442) (docs: reset staleness clock for curated context files (#4442) #4477)
• Since then: 16 commit(s) in scope; net diff 15 file(s), +798/-105 (903 lines, threshold 200)
• Modules added: src/bernstein/cli/commands/insights_cmd.py
• Top commits by churn:

Commit	Lines	Subject
62c88b2b7444	287	feat(review): run the fix-until-green contour inside review --pipeline (#4481) (#4518)
86e08b047942	162	feat(evolve): add --dry-run flag and failure-pattern draft GitHub sync (#4550)
e5912b1a8ab2	158	fix(pr): describe the pull request from the change, not the session (#4486)
13667b07958d	77	fix(agents-md): resolve default branch from the repository, not the checkout (#4578) (#4585)
c52f6752c4fb	70	feat(routes): remove legacy /dashboard in favor of gui serve (#4395) (#4430)

src/bernstein/core/orchestration/AGENTS.md

• Scope: src/bernstein/core/orchestration/
• Last touched: 34090c678fb6 (2026-08-24T19:45:14Z) — docs: reset staleness clock for curated context files (context-file staleness: curated context files lag their subtrees #4442) (docs: reset staleness clock for curated context files (#4442) #4477)
• Since then: 7 commit(s) in scope; net diff 7 file(s), +276/-8 (284 lines, threshold 200)
• Modules added: src/bernstein/core/orchestration/issue_claim.py
• Top commits by churn:

Commit	Lines	Subject
b752c201b9d2	106	feat: add claim comment format constants and helpers for issue-intake runs (#4609)
6c8a3362a78f	91	fix(replay): ensure plan.graph.full nodes are sorted by task_id in board projection (#4622)
5887cef21f48	48	fix(config): resolve run overrides from an untracked overlay (#4487)
4f913b54ea1e	32	fix(sla): attest an unresolved breach once, not once per tick (#4592)
5e12add2c516	3	feat(orchestrator): seed a bounded repair task on merge-gate failure (#4470)

src/bernstein/core/quality/AGENTS.md

• Scope: src/bernstein/core/quality/
• Last touched: 62c88b2b7444 (2026-08-25T10:29:00Z) — feat(review): run the fix-until-green contour inside review --pipeline (review --pipeline stops at a verdict; the fix-until-green loop and its provenance live outside the product #4481) (feat(review): run the fix-until-green contour inside review --pipeline (#4481) #4518)
• Since then: 5 commit(s) in scope; net diff 7 file(s), +302/-27 (329 lines, threshold 200)
• Top commits by churn:

Commit	Lines	Subject
df4d51f32194	127	fix(quality): name a missing mutation tool instead of reporting non-zero (#4576)
8f9c62858d20	83	feat(quality): empirical confidence helper with a Hoeffding confidence sequence (#4612)
9dc77120d5ac	76	fix(janitor): resolve test_passes paths against the tree before running them (#4554)
35c6c18e1672	38	fix(janitor): judge signal-less tasks instead of skipping them (#4563)
817b6f3fc66d	5	fix(evolution): stop reporting upgrades as applied when nothing reads them (#4586)

src/bernstein/core/security/AGENTS.md

• Scope: src/bernstein/core/security/
• Last touched: 34090c678fb6 (2026-08-24T19:45:14Z) — docs: reset staleness clock for curated context files (context-file staleness: curated context files lag their subtrees #4442) (docs: reset staleness clock for curated context files (#4442) #4477)
• Since then: 6 commit(s) in scope; net diff 6 file(s), +334/-28 (362 lines, threshold 200)
• Modules added: src/bernstein/core/security/key_derivation.py
• Top commits by churn:

Commit	Lines	Subject
b01b291c82f0	244	feat(security): add HKDF-SHA256 per-store key derivation with scheme versioning (#4483)
c2e7d236a7c9	67	fix(security): restrict redirect destinations for third-party-derived URLs (#4619)
4190a9212f0c	31	feat(security): opt-in host restriction for third-party-derived URLs (#4555)
804d8ea0d38d	11	fix(auth): dispatch honours the factory-resolved opt-out again (#4602)
817b6f3fc66d	9	fix(evolution): stop reporting upgrades as applied when nothing reads them (#4586)

tests/AGENTS.md

• Scope: tests/
• Last touched: 34090c678fb6 (2026-08-24T19:45:14Z) — docs: reset staleness clock for curated context files (context-file staleness: curated context files lag their subtrees #4442) (docs: reset staleness clock for curated context files (#4442) #4477)
• Since then: 70 commit(s) in scope; net diff 131 file(s), +12563/-1823 (14386 lines, threshold 200)
• Modules added: tests/chaos/conftest.py, tests/fixtures/receipt-vectors/_build_audit_receipt_vectors.py, tests/integration/test_sla_monitor_dedup.py, tests/unit/adapters/test_issue_4571_timeout_extension.py, tests/unit/agents/test_artifact_contract_prompt.py, tests/unit/cli/test_artifact_verify_key_handling.py, tests/unit/cli/test_evolve_dry_run.py, tests/unit/core/agents/test_reap_merge_quality_gates.py, tests/unit/core/replay/test_journal_unauthenticated_fields.py, tests/unit/core/tasks/test_blob_artifact.py (+39 more)
• Modules removed: tests/unit/test_auto_distillation.py, tests/unit/test_cascading_token_counter.py, tests/unit/test_dashboard_external_scripts.py, tests/unit/test_dashboard_responsive.py, tests/unit/test_token_waste_report.py
• Top commits by churn:

Commit	Lines	Subject
4a008e29c449	1437	fix(tokens): remove three caller-less modules and make the orphan guard correct (#4597)
62c88b2b7444	977	feat(review): run the fix-until-green contour inside review --pipeline (#4481) (#4518)
b01b291c82f0	618	feat(security): add HKDF-SHA256 per-store key derivation with scheme versioning (#4483)
5887cef21f48	535	fix(config): resolve run overrides from an untracked overlay (#4487)
543e5f20d1c7	496	feat: Create insights command and persistence module (#4598)

To clear a flag, review the context file against its scope and touch it in a commit — update it, or make a reconfirmation-only edit. Either way the "is this still true?" review leaves a commit that resets the clock.