bug: app-store: publisher gives strange, incorrect-hashed app out for auto-update (?)

Not sure exactly what is going on here. Publish process is something like:
1. `kit build`
2. put code hash in metadata.json
3. commit
4. `kit connect ...`
5. `kit s -p 9090`
6. `kit publish ...`

and publisher (first mirror) is giving out a hash that DNE on its disk!