Harden M9: Ed25519 attestation, full SHA-256 integrity, locked-by-default, prompt improvements, registry verification

tests/test_lockfile.py

@@ -259,6 +259,12 @@ class TestGenerateLockfile:
         assert "official/text-utils" in lock.packages
         assert lock.packages["official/summarize"].direct is True
         assert lock.packages["official/text-utils"].direct is False
+        child_identity = lock.packages["official/text-utils"].content_hash
+        assert child_identity.startswith("sha256:")
+        assert lock.packages["official/summarize"].dependency_hashes == {
+            "official/text-utils": child_identity
+        }
+        assert lock.packages["official/summarize"].content_hash.startswith("sha256:")
 
 
 class TestVerifyLockfile:
@@ -319,7 +325,9 @@ class TestLockfileRoundTrip:
                     integrity="sha256:abc123",
                     source="registry",
                     direct=True,
-                    required_by=[]
+                    required_by=[],
+                    content_hash="sha256:root",
+                    dependency_hashes={"official/text-utils": "sha256:child"},
                 ),
                 "official/text-utils": LockedPackage(
                     name="official/text-utils",
@@ -364,6 +372,10 @@ class TestLockfileRoundTrip:
         assert summarize.integrity == "sha256:abc123"
         assert summarize.source == "registry"
         assert summarize.direct is True
+        assert summarize.content_hash == "sha256:root"
+        assert summarize.dependency_hashes == {
+            "official/text-utils": "sha256:child"
+        }
 
         text_utils = loaded.packages["official/text-utils"]
         assert text_utils.direct is False