[Nic-dorman]

Part of the sha-fanout round (V2-1724): the SDK side of the sha256 fields antd 0.17.0 added in #347. Targets main; the daemon and antd-go are already released.

antd 0.17.0 returns the plaintext's SHA-256 on uploads and records one per
manifest entry (V2-1724). Carry it through the PHP client.

Upload results: DataPutResult, DataPutPublicResult, FilePutResult,
FilePutPublicResult and FinalizeUploadResult (finalizeUpload, wave and
merkle) gain ?string $sha256, read in the sync and Async paths. A missing
key (antd before 0.17.0), null or an empty string reads as null.

Manifests: ManifestEntryInput gains ?string $sha256, sent as "sha256" in
the entry only when set and non-empty (never null or ""), and passed through
exactly as given with no hex or length check. ManifestEntryInfo gains
?string $sha256, read from build and decode responses, null when absent
or empty. A bad value is the daemon's 400, which surfaces as the existing
BadRequestError with the server's message. There is no gRPC client in this
SDK.

Compatibility: the new constructor parameter is last with a default of null
on every type, so existing positional and named construction is unchanged.
Nothing breaking, no version bump. README documents the fields with "antd
0.17.0 or later".

Tests: tests/Sha256Test.php (36 mocked-HTTP tests: each upload result sync
and async with the key present, absent, "" and null; manifest build sends
and omits the key; entry info on build and decode; bad sha256 maps to
BadRequestError) and tests/LiveSha256Test.php, gated on ANTD_TEST_URL and
ANTD_TEST_SHA_LINK. Full suite 234 tests, 1050 assertions, 3 skipped (the
live tests). Live run against the v0.17.0 devnet daemon: fixture link
decoded, build with the public sha256, bad sha256 refused, and a public
upload of "sha-fanout php " returned the locally computed SHA-256.

🤖 Generated with Claude Code

[MaidSafe-Hermes]

APPROVE — reviewed head c0713f79b8b7c8d7e6c336f5149cdb3893318814.

Coverage: 2/2 seats reviewed (sol-1 gpt-6.1-sol xhigh; glm-1 z-ai/glm-5.3). Both seats agree; this is model agreement, not team consensus.

PHP REST upload mappings normalize absent/empty hashes; manifest input omits unset/empty values, and entry output reads the optional field. Tests cover these cases and preserve daemon validation errors. CI reports PHP 8.2/8.3/8.4 tests and Composer package consumption successful. Live daemon execution was not independently run here. No merge performed.