fix: npm SHA-1 checksums and drop sh package invoke

[undivisible]

Why

ArtifactChecksum::Sha1Hex hashed with SHA-256, so npm shasum verification could never match. Package export invoke also allowlisted sh, which is a shell execution surface.

What

• Hash SHA-1 checksums with sha1::Sha1 and test the known digest of hello world.
• env_clear() on curl_to_file (already used by curl_get).
• Remove sh from ALLOWED_INVOKE_PROGRAMS; reject it in a unit test.
• Switch go:fiber adapter to go run ./inauguration-invoke (argv, no shell).
• CI/release: permissions: contents: read on CI; persist-credentials: false on checkouts.

Tests

cargo test --features extended --locked --lib -- verify_archive_checksum require_https rejects_shell_invoke installs_path_dependencies
cargo clippy --all-targets --features extended --locked -- -D warnings
cargo fmt --check

Merge note

Do not auto-merge: this touches integrity verification and an execution allowlist.

---

Note

High Risk
Changes archive integrity checks and the package export program allowlist—both security-sensitive paths that could block valid npm installs or break adapters still using shell invoke.

Overview
Fixes npm tarball verification when registries expose legacy shasum (SHA-1 hex): Sha1Hex was compared against a SHA-256 digest, so installs could never validate; verification now uses sha1::Sha1 on the downloaded bytes, with a unit test for the known hello world digest.

Hardens registry fetch and package export execution: curl_to_file clears the environment like curl_get; sh is removed from ALLOWED_INVOKE_PROGRAMS so adapter JSON cannot spawn a shell (new rejection test). The go:fiber sample adapter is updated to go run ./inauguration-invoke instead of sh -c.

GitHub Actions on CI sets permissions: contents: read; CI and release jobs pass persist-credentials: false on actions/checkout.

^{Reviewed by Cursor Bugbot for commit 0ac8219. Configure here.}

[capy-ai]

Capy couldn't review this pull request because Max's workspace is out of credits, add credits or enable auto-reload to resume automatic reviews.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_72e36551-0480-47d0-8fc7-2bd6b0cfe22d)

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request