v0.2.0 — the log says when it has been edited

The record format moved: schema 1 → 3. Logs written by 0.1.1 still read — their
records verify as unverifiable rather than as damaged.

• Every record carries the hash of the one before it, and obstat verify
  recomputes the chain (schema 2). An edited line and a deleted line both show
  up; a truncated tail does not — tamper-evidence, not non-repudiation, and the
  spec says so in those words.
• Every decision carries a stable code beside the prose reason (schema 3).
  Filter, branch and assert on the code; read the reason. Until now the one
  load-bearing branch — pending retry vs hard denial — compared an interpolated
  sentence, so renaming a SQLite state would have turned every slow approval
  into a failed call.
• Three fixes closing the gap between what the record claims and what it does:
  a record is one unbuffered write() syscall however large it is; the write
  that creates the log fsyncs the directory entry too; and a subject
  parameter declared before a positional one no longer takes the caller's
  argument after the allow record is already on disk.