Proof-only public integrity verification (no auth)

Regulator-facing proof that a screening event exists and the audit chain is intact. No authentication required. Returns hashes, `match_count`, and integrity status only — never subject identifiers, match payloads, sources, or request/response snapshots. Full detail requires authenticated `GET /v1/audit/{audit_ref}`.