Define state-complete deterministic identity for Snapshot v2 packages

[valiantone]

Context

Snapshot identity is currently derived from the sorted list of content hashes. That is deterministic for a narrow content-only view, but it cannot distinguish changes to namespace or other portable record state that may affect the meaning of a clone. Package-file checksums also serve a different purpose: byte integrity is not the same as semantic snapshot identity.

What needs to be done

• Define a canonical semantic projection for snapshot identity, including scope and every portable field whose change must distinguish snapshots.
• Specify record ordering, null/default normalization, Unicode and JSON canonicalization, attachment-reference treatment, and hash-domain/algorithm version markers.
• Keep package-file checksums responsible for byte integrity and document the distinction from semantic identity.
• Define how existing content-hash-list IDs remain readable and identifiable.
• Add golden vectors and mutation tests for included semantic changes, excluded packaging noise, empty snapshots, and duplicate logical records.

Acceptance criteria

• Reordering records or JSON object keys does not change semantic snapshot identity.
• Changing namespace or any included portable state changes identity.
• Packaging timestamps, compression details, and other explicitly excluded transport noise do not change semantic identity.
• Empty snapshots and duplicate logical records have specified, tested behavior.
• The manifest exposes enough version information to distinguish identity algorithms.
• Legacy Snapshot v2 manifests remain verifiable under a documented compatibility rule.

Constraints and non-goals

This issue does not implement digital signatures, encryption, remote attestation, global package registries, distributed consensus, or network synchronization. A compatibility-breaking algorithm change requires an explicit versioning and migration decision.