fix(build): verify fixtures with two digests

[LMLiam]

Summary

• Require and stream-verify SHA-1 and SHA-256 for the fixture.
• Add both digests to the cache key and verify both digests on restored cache entries.
• Add deterministic cache-key tests and document the reviewed fixture baseline and update procedure.
• Align the build-logic source path with its declared package.

Related issues

Closes #380

Type of change

• fix: bug fix
• test
• docs
• chore / build / ci

Testing

• ./gradlew build --no-configuration-cache
• ./gradlew :buildSrc:test --rerun-tasks --no-configuration-cache
• ./gradlew :core:vanillaConformanceTest --rerun-tasks --no-configuration-cache
• ./gradlew ktlintCheck spotlessCheck --no-configuration-cache
• cd .github && npm run typecheck && npm run build && node --test actions/pr-metrics-comment/test/*.test.js scripts/*.test.js
• actionlint .github/workflows/ci.yml
• git diff --check

The live fixture matched SHA-1 823e2250d24b3ddac457a60c92a6a941943fcd6a and SHA-256 cdacdfb25898de5e4b4b0e5ddcc2722f77067e46605709c2d886c000ebb63ec5.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 78eefc18-4d0d-4815-9490-8d5153a2bb63

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}