Test canonical package hash verification

[shiny-code-bot]

Summary

• Add a regression proving package evidence hashed before GitHub repository canonicalization is rejected.
• Preserve the existing fail-closed verifier behavior while cbusillo/odoo-docker#66 aligns the image-side producer.

Context

OPW artifact run 29674807565 exposed a cross-repo contract mismatch: the image-side producer hashed raw GitHub URLs, while devkit canonicalized those identities to owner/repository before validating packages_sha256. The producer fix belongs in odoo-docker; this test prevents devkit from later accepting representation-dependent hashes as a workaround.

Validation

• uv run python -m unittest tests.test_artifact_provenance
• uv run python -m unittest discover -s tests — 223 tests, 1 skipped
• uv run ruff format --check tests/test_artifact_provenance.py
• uv run ruff check tests/test_artifact_provenance.py
• uv run platform --help
• PyCharm changed-files and whole-project inspections: GREEN

Refs #87
Related: cbusillo/odoo-docker#66