[CTX-0027] fix(registry): distinguish raw manifest digests from canonical H-B

[Xuepoo]

Priority: P2 | Area: package | Labels: fix, P2, area:package | Milestone: v0.1.0 | RFC: OQ-053 | Task: CTX-0027

Closes #53

Summary

Implements #53 (PLUG-REG-006): Clarify manifest_hash contract as H-A (raw bytes) for Phase 1.

The schema.json incorrectly described manifest_hash as "canonical H-B" but the implementation and README use raw SHA-256 over bytes (H-A). This creates a contract ambiguity where future consumers cannot safely distinguish semantic canonical hashing from transport bytes.

Changes

1. Updated schema.json to explicitly describe manifest_hash as H-A (raw-bytes digest) over fetched bitty-plugin.toml bytes, not H-B (semantic canonical hashing)
2. Added forward compatibility note that future phases will use version tagging to distinguish H-A from H-B (e.g., sha256-canonical-v1:)
3. Updated README to clarify manifest_hash is SHA-256 over transport bytes (H-A)
4. Updated all official registry entry comments to consistently describe H-A
5. Added tests to verify:
   • H-A produces different digests for semantically identical but differently formatted manifests (as expected for raw bytes)
   • Algorithm prefix allows future H-B migration via version tagging
   • Phase 1 rejects future canonical digest prefixes until implemented

Testing

• All existing tests pass
• New tests verify H-A vs H-B semantic distinction
• just check passes

This establishes an explicit versioned digest contract as required by the package-lifecycle-rfc.md, allowing safe future migration to H-B without breaking existing H-A entries.