fix(demo-tamper): ON CONFLICT DO NOTHING instead of INSERT OR IGNORE

Prod ships Postgres; `INSERT OR IGNORE` is SQLite-only and raised a
syntax error on the first /demo/tamper hit, which surfaced as a
raw 500. Swapped for `ON CONFLICT (entry_id) DO NOTHING` which works
identically on both dialects (SQLite 3.24+ + Postgres 9.5+).

Verified the audit_log PK is on entry_id so the conflict target is
valid. Re-ran tests/test_demo_tamper.py — 8/8 still green on the
local SQLite path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Sterling Ivey

haldir_demo_tamper.py

@@ -132,11 +132,15 @@ def ensure_seeded() -> None:
             return
         now = time.time()
         for r in SEED_ROWS:
+            # ON CONFLICT DO NOTHING works on SQLite 3.24+ AND Postgres 9.5+.
+            # "INSERT OR IGNORE" is SQLite-only and raises a syntax error on
+            # Postgres — bit us on prod before we caught it.
             conn.execute(
-                "INSERT OR IGNORE INTO audit_log "
+                "INSERT INTO audit_log "
                 "(entry_id, tenant_id, session_id, agent_id, action, tool, "
                 " details, cost_usd, timestamp, flagged, prev_hash, entry_hash) "
-                "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0, '', ?)",
+                "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0, '', ?) "
+                "ON CONFLICT (entry_id) DO NOTHING",
                 (
                     r["entry_id"], DEMO_TENANT, r["session_id"],
                     r["agent_id"], r["action"], r["tool"],