Draft evidence integrity design

[SSBrouhard]

Summary

• add a design doc for issue Add tamper-evident evidence ledger and verification command #2 before implementing tamper-evident evidence
• define the Tier 1 HMAC-chain boundary, including the compromised-broker residual
• specify MAC commitment, canonicalization, expected-head handling for tail truncation, three verifier states, legacy evidence compatibility, key rotation, and write-path concurrency/crash behavior
• link the draft from the evidence notes while preserving the current append-only/advisory claim

Validation

• .venv/bin/python scripts/vmga_release_check.py
• git diff --check
• claim-hygiene grep for tamper-proof/hash-chained/cannot_verify/expected-head boundary language

Closes no implementation issue yet; this is the design gate for #2.