mbo/hash: known-answer tests + SMHasher3 include-order fix; verify_digest_test bzl rule

[helly25]

The SMHasher3 build fix and the known-answer tests for the in-house hashes, in one commit (follows #243).

SMHasher3 include-order fix

smhasher3/mbohash.cpp included Hashlib.h before Platform.h. Platform.h defines seed_t and the FLAG_IMPL_*/FLAG_HASH_* enums the REGISTER_HASH macros rely on, so the reversed order put every $.field/flag out of scope and the reproducible build failed. This was the real cause behind the "build pin is broken" note from #243 (a misdiagnosis - the pin 6ab4343 is correct); that measurements/README "Open items" note is corrected here.

The include order is now pinned behind a // clang-format off guard, because SortIncludes alphabetizes Hashlib.h first and silently reverts it. Re-verified in a fresh container build (build_smhasher3.sh -> gcc:13): mumbo-64, jumbo-128, dumbo-64 all PASS.

Known-answer tests for the in-house mumbo/jumbo and dumbo

hash_test_vectors_gen emits hash_test_vectors.inc as one field-named constexpr struct array (reads like textproto, stays a compile-time header, no runtime parser). Regenerate intentionally on an algorithm change; the values are not stable across library versions.

Integrity is enforced in three independent layers:

• InHouseVectors (hash_test) re-derives every vector from the live algorithm, and per-algorithm CountKatAlgo(...) >= 20 asserts prove every in-house algorithm is covered with enough cases (all dispatch tiers, seeded and unseeded) - not an arbitrary total.
• hash_test_vectors_up_to_date_test (diff_test) compares the committed .inc against a freshly generated one, so a forgotten regeneration after an algorithm or generator change fails.
• hash_test_vectors_digest_test (verify_digest_test, below) checks the committed hash_test_vectors.inc.sha256 sidecar - an independently verifiable artifact anyone can re-check with stock sha256sum -c.

New rule: //mbo/digest:digest.bzl verify_digest_test

Given an algorithm and files mapped to a saved digest - either digests (a checksum sidecar file, preferred and externally verifiable) or checksums (an inline hex digest in the BUILD file) - it re-checks each file with //mbo/digest:digest --check, so a file may only change when its saved digest is updated in the same commit. Self-tested in mbo/digest against a fixture covering both forms.

Follow-up

With the plugin building reproducibly again, the authoritative smhasher.json can be produced by run_measurements.py on a clean main checkout after this merges (the last "Open items" entry).