save_filter_execution_log and append_worm_audit_record read the latest
chain hash and then insert as two separate statements with no lock,
letting concurrent appends read the same prev-hash and fork the
tamper-evident hash chain. Wrap each read+insert in a BEGIN IMMEDIATE
transaction so SQLite serializes the chain read against the dependent
insert.
Refs #245#164