How I built a tamper-evident AI agent audit log with Arkiv, signed hash chains, and browser-based verification, then tested it against forged entries.