Resolve final package review findings

[farach]

Summary

• replace unsupported tools::sha256sum() with byte-exact digest::digest(file = ..., algo = "sha256", serialize = FALSE) and add R 4.1 CI coverage
• add unique cache-lock ownership, owner-checked nonrecursive release, section transaction coordination, and configurable clear waiting
• snapshot local adapter files before hashing, receipt creation, and parsing while retaining the original source path
• redact malformed multi-@ user information through the final authority separator for absolute and // network-path URLs without hiding benign @ characters outside authority
• retain recoverable transaction state across marker write, state registration, and teardown deletion failures
• use safe path filenames or full raw URL SHA-256 identities for import cache names, with sensitive path redaction and content-aware opaque workbook/tabular parsing

Stack

• base branch: farach-harden-release-gates
• exact base and merge-base before edits: 053a184030713f19095e215ab2081751e867fe9c
• head: 66f38ad8a4b8b8d4963ef4d1cb7b1949df4c577e

Validation

• SHA-256 known vectors: empty file and exact abc bytes
• deterministic focused cache/import/redaction stress: 5 rounds, 328 passes per round
• final focused cache/import/redaction tests: 328 passes
• full devtools::test(): 929 passes, 0 failures, 0 warnings, 0 skips
• built and installed tests with network blocked: 922 passes, 6 existing CRAN-only skips, 0 failures
• clean-install validation: 68 exports in each of 2 rounds
• external R CMD check --as-cran: 0 errors, 0 warnings, 2 environment/submission notes
• pkgdown::check_pkgdown() and full site build: 87 HTML files, 643 rendered O*NET labels, 0 broken labels
• URL check: 6 URLs checked, 0 issues
• workflow YAML: 2 files parsed
• repeated read-only review findings were incorporated through complete reserved-name, opaque query/fragment, rootless-scheme, sensitive-path, encoded-separator, and quote-aware parser coverage

Notes

• R CMD check notes are the existing new-submission/development-version note and inability to verify current time.
• Pkgdown emitted 35 expected @examplesIf warnings across 2 unique interactive conditions.
• Optional lintr reports 23 findings in R/cache.R, 29 in R/imports.R, and 11 in the imports test file, predominantly existing line-length and cross-file symbol reports; R CMD check reports no code problems.
• air, spelling, and goodpractice were not installed locally.
• The R 4.1 gate builds and installs without vignettes before running the full installed-package suite, avoiding the legacy runner's unavailable pandoc-citeproc executable without weakening the existing release matrix.
• All 7 required hosted jobs passed on the final cache-name head. R workflow run: https://github.com/farach/onet2r/actions/runs/29107878480. Pkgdown workflow run: https://github.com/farach/onet2r/actions/runs/29107878470. The deploy job skipped by design on a pull request.

Draft only. Do not merge, tag, release, or delete branches pending independent review.