feat(go): chain retained snapshot artifacts

docs/GO_PORT_HANDOFF.md

@@ -1,8 +1,8 @@
 # Go Port Handoff
 
-Saved: 2026-07-22T02:03:00-07:00
+Saved: 2026-07-22T02:10:00-07:00
 Branch: `main`
-Base commit: `6d5a897` (`feat(go): persist Python-compatible incidents`)
+Base commit: `fd2bbba` (`feat(go): add bounded hot-path enrichment`)
 Status: implemented and green, but uncommitted
 
 ## Worktree warning
@@ -10,8 +10,9 @@ Status: implemented and green, but uncommitted
 The checkout is intentionally dirty and contains work from multiple related
 continuations. Do not reset, clean, or broadly restage it.
 
-- The validation-sidecar and incident-persistence tranches are committed as
-  `f85c2e8` and `6d5a897`. The bounded-enrichment slice is uncommitted.
+- The validation-sidecar, incident-persistence, and bounded-enrichment tranches
+  are signed commits `f85c2e8`, `538d1d9`, and `fd2bbba`. The local-assurance
+  slice is uncommitted.
 - At this checkpoint, `git status --short` has 20 entries with untracked
   directories collapsed.
 - The Python GUI files and tests are separate pre-existing work. Preserve them
@@ -94,8 +95,12 @@ static binary.
   context, lineage, remote-IP classification, and candidate paths entirely from
   already-captured records. Alert/process/indicator caps bound attacker-
   controlled work on the emission path.
-- Package ownership, executable hashes, file metadata, integrity anchors,
-  assurance chaining, and notification fan-out are not yet ported.
+- Snapshot log/JSON revisions now append synchronized private
+  `enodia.hash_chain.v1` records. Artifact SHA-256 is streamed, previous-hash
+  lookup reads a bounded chain tail, and append completion is synced before the
+  alert event is emitted.
+- Package ownership, executable enrichment hashes, file metadata, richer
+  integrity anchors, and notification fan-out are not yet ported.
 - No live system service was installed or enabled during development.
 
 ## Last green verification
@@ -140,9 +145,9 @@ the suite still exits successfully.
 
 ## Resume here
 
-1. Move slow enrichment collectors (ownership, bounded hashing, file metadata,
-   integrity anchors) behind a bounded asynchronous worker, then add local
-   assurance chaining without destructive response behavior.
+1. Move slow enrichment collectors (ownership, bounded executable hashing, file
+   metadata, integrity anchors) behind a bounded asynchronous worker without
+   destructive response behavior.
 2. Connect the isolated Go snapshot/event state to explicit read-only
    management consumers while keeping Python authoritative.
 3. Continue broader Phase 3 rule metadata/state parity before considering any