Report push hashes and harden the release path

[jserv]

hackmd_push_note now returns body_hash and remote_timestamp when it writes or finds nothing to write, so an agent can confirm a sync without a follow-up hackmd_get_note. Its success paths end in one place, and a large body is hashed once instead of up to three times. The rest closes the findings of a project analysis of what changed since the last one: the stdio tests no longer read a developer's real .env, which made make check fail for anyone following the setup; CI actions are pinned by commit, the release binaries build with the same pinned Rust as lint, and the release job attests its assets so a download can be checked beyond SHA256SUMS; and the README install commands work when pasted into zsh, the macOS default, where a trailing comment left $asset empty and the checksum step could never pass.

Verified locally: make check (266 unit and 11 stdio tests, with a real .env in the package root), cargo clippy with and without --all-features under -D warnings, cargo fmt --check, actionlint, shellcheck, and tests/install.py. Each code commit builds and passes on its own. The README install block was run against stubbed downloads under sh, bash, and interactive zsh, with a matching and a mismatched checksum. Codex and Claude reviewed the changes independently, and both resolved every pinned action SHA to its named release.

The attestation step runs only on a push to main, so it is first exercised after merge. The tool surface was reviewed for tools to remove; both reviewers found none worth the compatibility break, so all 14 stay.

---

Summary by cubic

hackmd_push_note now reports body_hash and remote_timestamp on a successful push or a no-op, so a caller can confirm the sync without a follow-up hackmd_get_note. The success paths end in one place, and a large body is hashed once instead of up to three times; conflicts and remote_changed results still return only remote_body_hash.

Release and CI hardening

• Pins every CI action to a commit and runs tests, lint, and the release binaries on the same pinned Rust compiler.
• Attests release assets with build provenance, and the README shows how to verify it beyond SHA256SUMS.

Other fixes

• Stdio tests run from a directory with no .env, so make check no longer fails for developers following the setup.
• README install commands now work when pasted into zsh, the macOS default, and use sha256sum -c - so the checksum check actually passes on macOS.

^{Written for commit acab735. Summary will update on new commits.}