EvidenceOS data flow (high-level, mock)

Sources -> Ingestion -> Evidence Store -> Runs -> Approvals -> Binder Export

All actions append to an audit ledger with hash chaining.
