Tamper detected — artifact hash no longer matches

Each artifact is fingerprinted with SHA-256; the root hash commits the whole corpus in one digest an investigator can audit offline.