test(hotpath): pin byte-locked checksum literals (LAB-1602)

[27Bslash6]

Closes LAB-1602.

Problem

The three checksum tests in hotpath/src/compute.rs asserted cachekit_core::checksum(x) against values derived from cachekit_core::checksum(x) itself — green for any implementation. A cachekit-core bump that moved the xxHash3-64 primitive could never fail CI; on LAB-1492 (#12) the 0.3→0.4 bump had to be verified by hand-diffing published crate sources.

Change (test-only)

• New checksum_matches_byte_locked_literals: pins checksum(b"") = 2d06800538d394c2 (the upstream xxHash3-64 reference vector — verifiable against the spec independent of cachekit-core), checksum(b"skyline") = 867903f9a19a1915, the canonical msgpack payload bytes for {"rust": 42}, and its checksum 573a48b587ebc7b9 (shared const RUST_42_XXH3). Payload bytes are pinned before the checksum so serialization drift can't masquerade as checksum drift.
• verify_reports_checksum_and_validity, verify_detects_corruption_via_expected_checksum, checksum_hex_roundtrip_and_rejection: expected values now come from the literals, not the live primitive. Zero tautological checksum assertions remain.

Same discipline as the existing derives_byte_locked_keys.

Proof

• Guard proven: perturbing one hex digit of RUST_42_XXH3 fails 3 tests with clear left/right hex diffs; restored → 14/14 green.
• Literals independently verified: review panel re-derived all three via Python's C-backed xxhash — all match.
• Local: cargo test --locked 14/14, cargo clippy --all-targets --locked -- -D warnings clean (native), cargo clippy --target wasm32-unknown-unknown --locked -- -D warnings clean.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 86d8a6d8-6f30-4664-8163-3784dde95a40

📥 Commits

Reviewing files that changed from the base of the PR and between e626a07 and 32df11a.

📒 Files selected for processing (1)

• hotpath/src/compute.rs

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

---

📝 Walkthrough

Summary by CodeRabbit

• Tests
  • Strengthened checksum validation coverage across empty, text, and structured data inputs.
  • Added fixed expected checksum values to improve consistency and detect unintended changes.
  • Improved round-trip verification reliability by checking against known results rather than generating values during testing.

Walkthrough

The checksum tests now use fixed xxHash3-64 literals. They verify canonical payload bytes and parse expected values from locked hexadecimal strings instead of generating checksums during assertions.

Changes

Checksum regression coverage

Layer / File(s)	Summary
Lock checksum test expectations hotpath/src/compute.rs	Added fixed checksum vectors and updated payload, corruption, and round-trip tests to use locked checksum values.

Merge Risk: ⚪ Minimal · up to 32df1

This test-only change replaces tautological checksum assertions with fixed reference literals, improving detection of checksum or serialization drift without changing production behavior; no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses conventional commit syntax and clearly describes the checksum test change. At 59 characters, it exceeds the preferred 50-character guideline, but it remains concise and descriptive.
Description check	✅ Passed	The description directly explains the test-only change, the removed tautological assertions, the byte-locked checksum literals, and the verification results.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[27Bslash6]

@27Bslash6 — ready for your signoff.

Automated review gates are clean on head 32df11a7:

• CI green (native + wasm32).
• CodeRabbit: Review completed, APPROVED on head, 0 unresolved review threads.
• Expert panel (elevated stakes, 4 agents): verdict SHIP — bug-hunter independently re-derived all three checksum literals; one craftsman MIN rejected with reasons.

Diff is test-only (hotpath/src/compute.rs, +25/−6), no production code. Review request could not be assigned via GitHub because you are the PR author — this mention is the handoff signal. Merge is yours.