feat(content-hash): add blake3_file primitive for dev daemon-identity isolation (#891)

[zackees]

What

Adds running_process::blake3_file(&Path) -> io::Result<Hash> (module content_hash, re-exported at the crate root, feature client) — the shared content-hash primitive requested in #891.

Why

soldr-daemon, FastLED/fbuild, and standalone zccache all obtain their daemon identity/discovery through running-process, and all three hit the same dev failure: two builds sharing one home root (e.g. ~/.soldr-dev) rendezvous on the same daemon pipe + pid file, each sees the other as "stale-version" and displaces it on every invocation — a displace-stale war that wedges the compile daemon. The shims are already version-namespaced; the daemon identity is not. Rather than reimplement isolation in each consumer, provide it once here — the common service everyone routes through.

The primitive

pub fn blake3_file(path: &Path) -> io::Result<Hash>;   // impl: Hasher::new().update_mmap_rayon(path)?

• Hashes the bytes, not the path string — path-hashing returns the same value across rebuilds → no isolation; content changes every build → identity changes every build (isolates same-version rebuilds), which is the whole point.
• mmaps the file, does not hash the loaded image — the mapped module is mutated by ASLR relocations, the resolved IAT, and live .data/.bss, so it differs from the file and differs every run (ASLR) → a nonce. update_mmap_rayon on the file is page-cache-warm and multi-core (~1–3 ms for a 20 MB binary).

Consumers stamp dev identity as "<version>-<first-16-hex of blake3_file(current_exe)>", computed once and propagated as a value down the process tree (see the issue for the client/daemon agreement).

Changes

• crates/running-process/src/content_hash.rs — the primitive + Hash re-export + 6 unit tests (hashes-bytes-not-path, path-independence, content-sensitivity, empty file, stable first-16-hex stamp, missing-file io::Error).
• Cargo.toml — enable blake3's mmap + rayon features (required by update_mmap_rayon).
• lib.rs — pub mod content_hash + pub use content_hash::blake3_file (both feature-gated on client, where blake3 already lives; soldr/zccache/fbuild all consume client).
• docs/api_snapshot_rust.txt — regenerated for the new re-export.
• CHANGELOG.md — Unreleased entry.

Validation

Local (MSVC), all via soldr cargo:

• soldr cargo test -p running-process --features client --lib content_hash → 6 passed
• soldr cargo clippy -p running-process --features client --lib -- -D warnings → clean
• soldr cargo fmt check → clean

Refs: zackees/soldr#2352 (design of record + evidence), zackees/soldr#2353 (interim soldr-side fix).

Closes #891

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!