Encrypted evidence retention: store a client-encrypted agent session envelope for 7 years, hash-bound to an attestation