fix(setup-preflight): accept sha512 in svn-zip locks

[MakerFlyFly]

Summary

• The documented svn-zip project lock includes sha512:, but the original parser rejected it and made the shared pre-flight exit 2 before reporting setup findings.
• Accept and retain the digest only for method: svn-zip, independent of field order. Invalid methods and empty digests raise MalformedLock; scalar keys come from Lock while plugins and reconciled remain structured blocks.
• Add regression coverage for these boundaries, unknown keys, and both existing forms of a svn-zip local lock. The original fix remains in history; the review revision is appended to it.

Type of change

• Python package (tools/*/ with pyproject.toml)

Test plan

• prek run --all-files passes, including lychee, workspace checks and skill-script tests.
• Python 3.11.2 and 3.12.12: all 156 setup-preflight tests pass.
• Ruff check, Ruff format check, and member-config mypy (18 source files) pass.
• On 20cbbc56, all 15 method-restriction and empty-value diagnostic cases fail; they pass with the revision. The original parser compatibility regression was separately demonstrated on 4556f693.
• Actual CLI: 20 scenarios cover both key orders, four other installation methods, missing/unknown methods, empty/comment-only digests, sha521:, and invalid scalar assignments to structured blocks. Invalid cases exit 2; valid svn-zip locks still report snapshot-never-fetched and sweep-never-run.
• Existing svn-zip local locks with empty or version-shaped fetched_commit remain readable when recorded pin fields match.
• Independent zizmor check passes.

RFC-AI-0004 compliance

This parser-only correction restores the documented lock contract. It adds no outbound action, host access, configurable skill policy, or LLM data flow. No skill prompt material, dependency or local-lock schema changes.

Linked issues

Closes #1595.

Notes for reviewers (optional)

This PR targets apache/magpie:main from MakerFlyFly:fix/setup-preflight-svn-zip-sha512. The author has completed human review. The two commits retain the original fix and its scoped review revision; the aggregate diff is limited to lockfile.py and test_core.py (+70/-2). Public audit records: MakerFlyFly#4 and MakerFlyFly#5.

Scope and remaining limits: this fixes parsing and the applicability of the new digest field. It does not provide SHA-512 drift detection or ZIP integrity attestation. upgrade.md requests a security-flagged finding when a digest changes under the same version, but the existing local lock records no fetched digest. Implementing that requires coordinated persistence, parser, comparison and legacy-lock changes and is a separate task. This revision does not add digest format checks, duplicate-key policy, general per-method schema validation or a documentation-template test harness.

How svn-zip adopters receive the fix: the maintainers must advance the committed pin to a release that contains it, install/upgrade to that snapshot, and refresh the personal checker from that updated source. Repeating config or upgrade with the same affected pinned snapshot copies the old parser again and does not fix this error. This PR does not change adopter pins or automate an upgrade.

Validation uses a Linux checkout with real Git symlinks and Docker --init; the Windows checkout keeps its existing symlink configuration. Prior reproduction and validation records are preserved, and revision records are stored separately. Python 3.9 is outside the package's declared Python 3.11+ support range.

---

Generative AI (Codex, GPT-6) assisted reproduction, implementation and validation. The author has completed human review of the final change and owns this contribution; upstream maintainer review is pending.

Suggested labels: bug, family:setup, substrate:setup, capability:fix.

[potiuk]

LGTM — a real fix: locks.md and install.md both tell svn-zip adopters to write sha512:, and the parser rejected it, so every skill's pre-flight failed for anyone installed from the signed source release. The digest is accepted only for method: svn-zip regardless of field order, empty and misspelt keys are still rejected, the structured blocks can't take a scalar, and the tests pin each of those boundaries along with both existing forms of an svn-zip local lock. CI is green.

Thank you for the careful write-up, including the scope note: re-fetch digest comparison is indeed separate work, and the note on how svn-zip adopters receive the fix (a new release, then an upgrade from it) is right.

---

This review was drafted by an AI-assisted tool and
confirmed by an Apache Magpie maintainer. The maintainer
approving this PR has read the findings and signed off. If
something feels off, please reply on the PR and a maintainer
will follow up.

More on how Apache Magpie handles maintainer review:
Contributing guide.