fix(setup-preflight): accept sha512 in svn-zip locks

[MakerFlyFly]

Summary

• The documented svn-zip project lock includes sha512:, but the original parser rejected it and made the shared pre-flight exit 2 before reporting setup findings.
• Accept and retain the digest only for method: svn-zip, independent of field order. Invalid methods and empty digests raise MalformedLock; scalar keys come from Lock while plugins and reconciled remain structured blocks.
• Add regression coverage for these boundaries, unknown keys, and both existing forms of a svn-zip local lock. The original fix remains in history; the review revision is appended to it.

Type of change

• Python package (tools/*/ with pyproject.toml)

Test plan

• prek run --all-files passes, including lychee, workspace checks and skill-script tests.
• Python 3.11.2 and 3.12.12: all 156 setup-preflight tests pass.
• Ruff check, Ruff format check, and member-config mypy (18 source files) pass.
• On 20cbbc56, all 15 method-restriction and empty-value diagnostic cases fail; they pass with the revision. The original parser compatibility regression was separately demonstrated on 4556f693.
• Actual CLI: 20 scenarios cover both key orders, four other installation methods, missing/unknown methods, empty/comment-only digests, sha521:, and invalid scalar assignments to structured blocks. Invalid cases exit 2; valid svn-zip locks still report snapshot-never-fetched and sweep-never-run.
• Existing svn-zip local locks with empty or version-shaped fetched_commit remain readable when recorded pin fields match.
• Independent zizmor check passes.

RFC-AI-0004 compliance

This parser-only correction restores the documented lock contract. It adds no outbound action, host access, configurable skill policy, or LLM data flow. No skill prompt material, dependency or local-lock schema changes.

Linked issues

Closes #4.

Notes for reviewers (optional)

This Draft PR targets MakerFlyFly/magpie:main for human audit before any upstream submission. It retains the original 20cbbc56 fix and adds a review revision, with the aggregate code diff still limited to lockfile.py and test_core.py.

Scope and remaining limits: this fixes parsing and the applicability of the new digest field. It does not provide SHA-512 drift detection or ZIP integrity attestation. upgrade.md requests a security-flagged finding when a digest changes under the same version, but the existing local lock records no fetched digest. Implementing that requires coordinated persistence, parser, comparison and legacy-lock changes and is a separate task. This revision does not add digest format checks, duplicate-key policy, general per-method schema validation or a documentation-template test harness.

How svn-zip adopters receive the fix: the maintainers must advance the committed pin to a release that contains it, install/upgrade to that snapshot, and refresh the personal checker from that updated source. Repeating config or upgrade with the same affected pinned snapshot copies the old parser again and does not fix this error. This PR does not change adopter pins or automate an upgrade.

Validation uses a Linux checkout with real Git symlinks and Docker --init; the Windows checkout keeps its existing symlink configuration. Prior reproduction and validation records are preserved, and revision records are stored separately. Python 3.9 is outside the package's declared Python 3.11+ support range.

---

Generative AI (Codex, GPT-6) assisted reproduction, implementation and validation. Review feedback has been incorporated within the stated scope; the revised Draft PR awaits another human audit and does not claim human approval.