feat: immutable audit trail with Sigstore/Rekor attestation + HIPAA compliance mode

- sigstore_attestation.py: keyless Sigstore signing (Fulcio/Rekor) with
  Ed25519 fallback; index file; path-traversal-safe verification
- hipaa.py: PHI detection (SSN/MRN/DOB/phone/email/ICD/diagnosis),
  AES-256-GCM encryption at rest, PHI file access controls, BAA-ready
  compliance report, HIPAAMode integration helper
- compliance.py: CompliancePreset.HIPAA preset wiring
- 17 sigstore + 53 HIPAA tests all passing; ruff clean

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: chernistry