[Nic-dorman]

Part of the sha-fanout round (V2-1724): the SDK side of the sha256 fields antd 0.17.0 added in #347. Targets main; the daemon and antd-go are already released.

V2-1724. antd 0.17.0 reports the plaintext's SHA-256 (lowercase hex) on
uploads and lets a manifest entry record one. Read it on the five upload
results (data_put, data_put_public, file_put, file_put_public and
finalize_upload / finalize_merkle_upload, which share one result type) and
carry it through manifest entries.

Upload results get a sha256 field, a string when the daemon sends one and nil
when the key is missing (antd before 0.17.0), null or "". The model
constructors take it as a new last argument, so existing calls keep working.
Manifest entries accept an optional sha256 on build_manifest input: it is
passed to the daemon exactly as given (no hex, length or case check) and left
out of the request when unset or "". Entries read back from a build or decode
carry sha256, nil when absent or "". A daemon 400 for a bad sha256 surfaces
as the existing bad_request error with the daemon's message. Only a
non-string sha256 is refused client-side, like path, in the same entries[i]
form. opt_str moved above its first use in client.lua; no behaviour change.

Tests: 18 new busted cases over mocked HTTP (every upload result with the
key present, absent, "" and null; manifest build request omit/send; entry
reads on build and decode; 400 mapping), 230 passing on Lua 5.1, LuaJIT and
5.4. spec/live_sha256_spec.lua (ANTD_TEST_URL + ANTD_TEST_SHA_LINK) passes
against an antd 0.17.0 devnet, including one paid public upload whose
sha256 matches the locally computed digest. README documents the fields with
"antd 0.17.0 or later". Not breaking.

🤖 Generated with Claude Code

[MaidSafe-Hermes]

APPROVE — reviewed head 45b35fef373b4db74846c7a4238e5e7f4958ab31.

Coverage: 2/2 seats reviewed (sol-1 gpt-6.1-sol xhigh; glm-1 z-ai/glm-5.3). Both seats agree; this is model agreement, not team consensus.

The Lua REST changes add optional hash reads to upload/finalize results, omit unset manifest inputs, normalize absent/empty outputs, and include mock coverage and 0.17.0+ documentation. No source-confirmed blocker found. No checks are reported for this branch; the parent Linear comment reports fanout verification and live devnet tests, which I did not independently rerun. No merge performed.