feat(kernel): establish ordered native audit root and verifier handoff

Outcome

The native kernel emits a bounded total order of security-relevant events and maintains a rolling cryptographic root that an isolated verifier can reconstruct, detect tampering against, and attest without making the verifier or log a source of authority.

Parent and dependencies

Child of #1316 and Tracking #1564. Depends on #1705 for authenticated native IPC and on the native legibility outcome for stable typed object attribution.

Scope

Private native contracts for sequence, event class, typed subject/object attribution, rolling root, bounded handoff, loss/failure indication, and verifier reconstruction. No public audit WIT, operator retention policy, federation, or release attestation.

Exit gate

• The verifier reconstructs the exact kernel root from the ordered event stream.
• Mutation, omission, reordering, duplication, stale generation, overflow, verifier crash, and restart fail closed or produce an explicit incomplete result.
• Domain/IPC lifecycle events retain typed attribution through teardown.
• q35/TCG evidence, tamper corpus, exact-head review, and native-kernel CI pass.

Claim boundary

This proves native audit-chain mechanics under the semantic harness, not durable production retention, physical-machine trust, or cross-device attestation.