feat(dynamic-workflow): tamper-evident integrity ledger for repair_cache and events

plugins/hetaoBackend/mcode-dynamic-workflows/README.md

@@ -60,6 +60,7 @@ Reuse proves only that the context was identical and that the stored result was
 - Real agents run through the user's MCode CLI with its configured provider, tools and smart permissions. Project materials and prompts may be sent to that provider; agents may access other destinations and modify files as the task permits. These destinations depend on the user's configuration and task. Credentials remain managed by the CLI; the plugin does not ask for or store credentials, but prompts/outputs/logs can contain sensitive information supplied by users or tools.
 - QuickJS isolates the orchestration script from direct Node/file/network access. **The spawned MCode agents are not an OS sandbox** and do not inherit the full parent conversation. Review prompts, budgets, side effects and permissions before execution or retries.
 - A lifetime SQLite lock enforces one state owner even if a discovery lockfile is lost. The run list prioritizes active runs and recovery attention within its 100-entry window; crash recovery inspects every unfinished run.
+- Tamper evidence: the append-only `events` and `repair_cache` surfaces each carry a SHA-256 hash chain whose per-row links are written in the same transaction as the insert. Digests bind each row's identity (`runId` plus `seq`/`id`) as well as its body, so moving a row to another run is detected like any body edit. The ledger lives in the same SQLite database as the data it covers: it is in-database tamper evidence, not an independent trust anchor. A party able to rewrite the whole database can also recompute the ledger and heads, so `verified: true` must not be read as proof against that attacker. What it does catch is accidental edits, partial rewrites, and tooling mistakes that leave the ledger inconsistent with the rows. `workflow_status` with `verifyIntegrity: true` recomputes both chains and returns heads, per-face verdicts and the first divergence. Verification covers the anchored prefix; any unanchored row fails closed (`unchained > 0` → `verified: false`). The default run list stays a plain JSON array; the object form with `integrityHeads` is only returned for `verifyIntegrity: true`.
 - The project service and approved workflows survive a chat disconnect. No OS autostart is installed; machine shutdown interrupts execution. After abnormal termination, verify old agents have stopped before recovery.
 
 ## Source, build and tests