update-aqua-checksum: build the commit payload on disk, never on a command line

[closer-claudio]

The failure

ossein-kernel#43 came out of this workflow with a bumped limen pin, no checksum for it, and a pipeline that died before its first recipe:

▶ lint: limen
aqua failed … package_version=v0.2.1 error="checksum is required"

Because the job that writes the checksum had already died:

/usr/bin/jq: Argument list too long
##[error]Process completed with exit code 126

Why

Converging the baseline across a limen release rewrites the whole .limen/ tree. Measured in ossein-kernel:

.limen/** + aqua-checksums.json	118,635 bytes
as base64 in one --argjson argument	~158,180 bytes
Linux MAX_ARG_STRLEN	131,072 bytes
	1.2× over

The same data then went through argv a second time as curl -d "${payload}", so fixing only the first site would have moved the failure one line down.

The fix — three sites, all now reading from disk

was	is
--arg contents "$(base64 -w0 …)"	--rawfile contents
--argjson additions "${additions}"	--slurpfile additions
curl -d "${payload}"	curl --data-binary @file

Only short scalars stay on a command line — a path, a branch, a commit oid. The payload no longer has a size ceiling at all, rather than a larger one.

Why limen never saw it

The convergence step is skipped in this repository by design:

# Skipped in the limen repository itself: there the working tree IS
# the next baseline …
if: github.repository != 'farcloser/limen'

So limen's own aqua-bump commits one small file (aqua-checksums.json, ~18 kB of base64) and never approaches the limit — #79 is green for that reason, not because the mechanism works. The failure needs a repository that both pins limen and has drifted far enough for the convergence to be large, which is every governed repository once its limen gap is wide enough.

Verification

Simulated a 173 kB dirty tree of 21 entries (20 modified/added, 1 deleted):

• 20/20 additions decode byte-identically through base64, and the deletion is carried
• the array that used to become one argument measures 232,235 bytes; the largest single file's base64 is 23 kB
• just lint and just test green

The overflow itself cannot be reproduced on darwin, which has no per-argument limit — the old logic passes locally at 232 kB. On Linux it is the difference between 232 kB and 128 kB.