fix(fnos): stabilize runtime content fingerprint

scripts/build-fnos.sh

@@ -88,7 +88,7 @@ for candidate in "$STAGE/app/runtime/"imagefind-*.whl; do
 done
 [ -n "$STAGED_APP_WHEEL" ] || { printf 'built application wheel is missing\n' >&2; exit 1; }
 PACKAGE_ID=$("$PYTHON_BIN" -c \
-    'import hashlib,sys; h=hashlib.sha256(); [h.update(open(path,"rb").read()) for path in sys.argv[1:]]; print(h.hexdigest())' \
+    'import hashlib,sys,zipfile; h=hashlib.sha256(); z=zipfile.ZipFile(sys.argv[1]); [(h.update(n.encode()),h.update(z.read(n))) for n in sorted(z.namelist())]; h.update(open(sys.argv[2],"rb").read()); print(h.hexdigest())' \
     "$STAGED_APP_WHEEL" "$STAGE/app/runtime/runtime-core.txt")
 printf '%s\n%s\n%s\n' "$PACKAGE_VERSION" "$APP_VERSION" "$PACKAGE_ID" >"$STAGE/app/runtime/VERSION"
 "$PYTHON_BIN" "$PROJECT_ROOT/scripts/make_icons.py" "$STAGE"

tests/test_fnos_lifecycle.py

@@ -141,7 +141,7 @@ def test_fnos_wizard_contracts():
     assert ".fnos-wheel-cache/python312" in build_script
     assert "vendor/qdrant" not in build_script
     assert "vendor/ffmpeg" not in build_script
-    assert f"imagefind-{manifest_version}-x86_64.fpk" in build_script
+    assert 'imagefind-${PACKAGE_VERSION}-x86_64.fpk' in build_script
 
 
 def test_generated_fnos_icons_fill_the_opaque_canvas(tmp_path: Path):