Content Hash

The content-addressed identity of this EphemeralPackage — the SHA-256 (prefixed `sha256:`) of its body in canonical form. Recorded as a property rather than the package name so the colon-bearing hash never has to be parsed as part of an address; the package name carries a short, address-safe digest derived from it. Same computation + same inputs produce the same hash, so identical results are dedupable and safely cacheable by this value. The hash covers the body (the response resources) only — never the header, `resolvedAt`, or `id` — so two identical computations run at different times still match.