[Nic-dorman]

Part of the sha-fanout round (V2-1724): the SDK side of the sha256 fields antd 0.17.0 added in #347. Targets main; the daemon and antd-go are already released.

antd 0.17.0 reports the plaintext's SHA-256 (lowercase hex) on every
upload response (V2-1724). Add sha256: Option<String> to DataPutResult,
DataPutPublicResult, FilePutResult, FilePutPublicResult and
FinalizeUploadResult, the last shared by wave-batch and merkle finalize.
They map POST /v1/data, /v1/data/public, /v1/files, /v1/files/public and
/v1/upload/finalize over REST, and PutDataResponse (5),
PutPublicDataResponse (5), PutFileResponse (6), PutFilePublicResponse (7)
and FinalizeUploadResponse (5) over gRPC.

A missing key (antd older than 0.17.0) or an empty string, which is the
proto string's zero value, reads as None. The hash is passed through as
the daemon sent it. The manifest entry fields were already carried by
80fdb3b and are untouched, apart from README wording.

The new field is public on structs that callers may build by literal, so
a literal construction of one of these five needs sha256: None. antd-rust
0.4.0 is unpublished, so this joins it; no version bump. Reading the
results is unaffected.

Tests: 11 new unit tests (181 lib tests in all) cover REST present,
absent and empty for all five results (wave and merkle finalize), gRPC
present and empty for the same, and a daemon 400 for a bad manifest-entry
sha256 surfacing as BadRequest. tests/live_sha256.rs, gated on
ANTD_TEST_URL and ANTD_TEST_SHA_LINK, decodes the fixture link, builds a
manifest with and without a bad hash, and makes one public upload per
transport checking the reported hash against sha2 computed locally. It
adds sha2 as a dev-dependency (already in the lock file).

🤖 Generated with Claude Code

[MaidSafe-Hermes]

APPROVE — reviewed head 0ee566051bced2f063f8d4b8f2376418b9bebe1c.

Coverage: 2/2 seats completed. Both returned UNCERTAIN because the unchanged manifest implementation was not in their diff evidence. I checked antd-rust/src/manifests.rs at the exact base revision; it already includes sha256, with_sha256, and REST/gRPC conversion paths, consistent with this PR's upload-results-only scope. sha2 is in [dev-dependencies], not production dependencies.

REST/gRPC upload result mappings normalize absent/empty hashes, and CI's Rust checks pass. The OSV audit separately fails on RUSTSEC-2026-0386 for tokio 1.52.3 in antd-rust/Cargo.lock; the base and PR lockfiles resolve the same Tokio version, so this finding is not introduced by this change. The parent Linear comment reports live verification; I did not independently rerun the paid test. Code-review approval only; no merge performed.