security: pinned checksums for `perry.nativeLibrary` archives

[proggeramlug]

A swapped or tampered .a / .lib / .dylib file is currently undetectable — Perry resolves the path and links whatever's there. Same model as package-lock.json's integrity field would close this.

Mechanism

When resolving a perry.nativeLibrary archive, compute SHA-256 and write to perry.lock (or extend the existing lockfile if one already exists). On subsequent builds, verify; mismatch fails with:

archive for X changed since last accepted; review and run \perry lock --update X` if intentional.`

Zero runtime cost (compile-time hash check on resolved archive).

Acceptance

• First-time resolution writes hash to perry.lock
• Subsequent builds verify against locked hash
• Mismatch fails with actionable error
• perry lock --update <pkg> to deliberately bump
• Hash covers every per-target archive declared by the package, not just host arch
• CI-friendly: perry lock --frozen mode for verification-only

---

Part of the supply-chain hardening series. Host-app-controlled (lockfile lives in host repo). Zero runtime cost.