Consumer checks need exact commit SHAs, not tags #154

Finding (as written in the restart doc, ChatGPT batch 3): consumer checks need exact SHAs.

Suggested fix: consumers that check a preprocessing output must compare the exact commit SHA recorded in the output, not a tag or branch name. Add a test where a tag moves and the check still refuses.

Source: ChatGPT audit batch 3 (core), 2026-11-04; restart doc "Batch 3 FILE items".