Verify walks all *.jsonl files in name order and checks the hash chain.
It returns the last hash and the number of lines. A missing or empty
dir yields ("sha256:0", 0, nil). Errors name <file>:<line>.
type Writer struct {
// contains filtered or unexported fields
}
Writer appends chained, fsynced lines. Safe for concurrent use, and across
processes sharing the same dir (exclusive flock on <dir>/.lock per Write;
the chain tail is re-read from disk inside the lock).
Open creates dir (0700, chmod'ed if it already exists), chmods existing
*.jsonl files to 0600 and checks the chain tail. An unparsable last line is an error.