copy: qualify hashing claims (trace, supplier-compliance, export)

frontend/src/app/supplier-compliance/page.tsx

@@ -70,7 +70,7 @@ const FAQ = [
     },
     {
         q: 'Is my data secure?',
-        a: 'Yes. Every submission is SHA-256 hashed and cryptographically chain-linked. Data is stored in tenant-isolated databases with row-level security. Your data is only visible to you and the buyer who generated your portal link.',
+        a: 'Submissions are SHA-256 hashed and cryptographically chain-linked where enabled. Hashing is a RegEngine feature, not an FDA requirement. Data is stored in tenant-isolated databases with row-level security. Your data is only visible to you and the buyer who generated your portal link.',
     },
     {
         q: 'What does this cost me?',

frontend/src/app/tools/export/page.tsx

@@ -46,12 +46,12 @@ const PACKAGE_PARTS = [
   {
     icon: Shield,
     title: 'Chain Verification',
-    body: 'SHA-256 hash chain proving record integrity. Each event cryptographically linked to its predecessor.',
+    body: 'SHA-256 hash chains support tamper detection where enabled. Hashing is a RegEngine feature, not an FDA requirement.',
   },
   {
     icon: FileCheck,
     title: 'Package Manifest',
-    body: 'Cryptographic manifest with file checksums. Independent verification without RegEngine.',
+    body: 'Manifest with file checksums for checking content hashes where enabled.',
   },
 ];
 

frontend/src/app/trace/page.tsx

@@ -340,7 +340,7 @@ export default function TracePage() {
                 <div className="min-w-0">
                   <CardTitle>CTE Event Timeline</CardTitle>
                   <CardDescription className="mt-1">
-                    Each event is cryptographically hashed (SHA-256) for tamper-evident traceability
+                    Events are SHA-256 hashed where enabled. Hashing is a RegEngine feature, not an FDA requirement.
                   </CardDescription>
                 </div>
               </CardHeader>