Tamper-evident, independently-verifiable receipts for AI artifacts — a single Rust binary (CLI + MCP server) with five real cryptographic layers and always-offline verify.