chore(audio): migrate stable fingerprints to sha2 0.11

[thewrz]

This was written agentically; verify its assertions:

Why

Sha2 0.11 returns a digest without LowerHex support, so a dependency-only bump fails to compile. Content fingerprints are persisted and must remain byte-identical across this upgrade.

What

Encode each SHA-256 byte as two lowercase hexadecimal digits and pin the persisted identity with a fixed-input regression covering leading and full zero bytes. Upgrade sha2 to 0.11, regenerate Flatpak Cargo sources, and remove the obsolete Renovate version hold. Existing Iced dependencies retain sha2 0.10 transitively; no new direct dependency was added.

Testing

• cargo test --locked: 961 passed, including fingerprint regression
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo fmt -- --check
• cargo deny check
• cargo build --locked --release
• bash tests/packaging/flatpak_cargo_sources_fresh.sh
• cargo test --locked --features pipewire-test --test pipewire_integration --test stream_watcher_integration -- --test-threads=1: 9 passed
• Full current-head CI at 7cadaaf, including release, MSRV, deny, lint, tests, source freshness and all three AUR packages

The prior one-shot adversarial review had no findings; its receipt remains in the PR comments. Coverage was not measured locally because cargo-tarpaulin is unavailable.

Closes #266

🤖 Co-authored by Codex.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 7ffba3f2-b77c-4526-bfc2-874fc3c4c245

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[thewrz]

This was written agentically; verify its assertions:

Adversarial review receipt

• Reviewer: provider=anthropic; model=claude-fable-5-1; effort=xhigh; mode=cross-provider (reason: Repository-declared peer reviewer; one review under current auto-review consent)
• Launcher: adversarial-run.sh sha256=4d1fc623db1b387d5d6dc0792b56ea5fcc25bf1297a77b9aca4dab243902bd50; attempt=38fecddf-cfa1-4a1c-88b3-9e48d3fd889b
• Procedure: one-shot diff review; no contract-blind or two-pass attestation
• Counts: P1=0; P2=0; total=0
• Reviewed head: bc7a0d0
• Diff payload: wrzonance/HonkHonk:272:11f88a922a4781be7992446a86133fb8cc1a49b5eb00253ec6b7f7f678978d8a
• Verification: verification=partial-ci-on-stacked-base; observed evidence={"state":"partial-ci-on-stacked-base","reference":{"pr":271,"sha":"a9db58cce31b952eed22edca7b847b98e010459a","base":"main"},"missing":[{"app_id":15368,"name":"Build (release)"},{"app_id":15368,"name":"Deny (licenses + advisories + bans)"},{"app_id":15368,"name":"LOC delta check"},{"app_id":15368,"name":"Lint (clippy + fmt)"},{"app_id":15368,"name":"MSRV (build)"},{"app_id":15368,"name":"Test (unit)"},{"app_id":57789,"name":"clippy"}]}; cause and requiredness are unknown. Observe checks after any retarget; local verification is separate evidence.
• Confirmed finding: none confirmed
• Execution: performed; adjudication=recorded
• Remediation: complete

🤖 Co-authored by Codex gpt-6-astra.

[thewrz]

This was written agentically; verify its assertions:

Review ledger

Machine-readable record of every review already performed on this PR.

{
  "version": 1,
  "pr": 272,
  "repo": "wrzonance/HonkHonk",
  "reviews": [
    {
      "kind": "adversarial",
      "provider": "anthropic",
      "model": "claude-fable-5-1",
      "effort": "xhigh",
      "mode": "cross-provider",
      "attemptId": "38fecddf-cfa1-4a1c-88b3-9e48d3fd889b",
      "launcherSha256": "4d1fc623db1b387d5d6dc0792b56ea5fcc25bf1297a77b9aca4dab243902bd50",
      "procedure": "one-shot diff review; no contract-blind or two-pass attestation",
      "reviewerOverride": "",
      "harness": "codex",
      "head_sha": "bc7a0d09ddf0795e2a9ec771cb2675320e5a575e",
      "covered_heads": [
        "bc7a0d09ddf0795e2a9ec771cb2675320e5a575e"
      ],
      "diff_payload": "wrzonance/HonkHonk:272:11f88a922a4781be7992446a86133fb8cc1a49b5eb00253ec6b7f7f678978d8a",
      "findings": [],
      "counts": {
        "p1": 0,
        "p2": 0
      },
      "reviewed_at": "2026-09-16T04:51:11Z"
    }
  ]
}

🤖 Co-authored by Codex gpt-6-astra.