refactor(artifact)!: make artifact digests typed

[wolfv]

Summary

Makes artifact inputs explicit and type-safe before 1.0:

pub enum Artifact<'a> {
    Blob(&'a [u8]),
    Digest(ArtifactDigest),
}

ArtifactDigest carries its HashAlgorithm and validates the digest length at construction. Verification therefore rejects algorithm mismatches instead of interpreting arbitrary bytes according to whichever bundle field is inspected later.

Signing now accepts SHA-256 digest input as documented, signs it directly in prehashed mode, and uses the same value in the hashedrekord entry. Supplying a digest explicitly means the caller—not the library—is asserting the artifact identity.

Stack

1. fix(sign): keep unbounded hashing and signing from starving the async executor #183: incremental/prehashed signing foundation
2. This PR: typed blob and digest inputs
3. feat(artifact)!: stream artifacts from sync and async readers #185: synchronous and asynchronous reader APIs

BREAKING CHANGE: digest inputs must use ArtifactDigest; untyped DigestBytes conversions are removed and Artifact::Bytes is renamed Artifact::Blob.

Signed-off-by: Wolf Vollprecht w.vollprecht@gmail.com

[jku]

lgtm -- although I actually reviewed the version 20 mins ago (before the rebase): I'm assuming it was a clean rebase, let me know if there were actual changes