feat: content hashing with staleness detection and AI spec regen

[corvid-agent]

Summary

Phase 1 — Content Hashing:

• SHA-256 content hashing to skip re-validation of unchanged specs — hashes stored in .specsync/hashes.json (gitignored local state)
• Tracks spec files, companion files (req/context/tasks), and source files from frontmatter files: list
• --force flag bypasses cache; --strict always re-validates
• Cache only persisted when validation has zero errors

Phase 2 — Staleness Detection & AI Regen:

• ChangeKind enum (Spec, Requirements, Companion, Source) classifies what changed per spec instead of just whether anything changed
• Requirements drift → yellow warnings in check output; interactive TTY prompt to re-validate
• --fix + requirements changed → auto-regenerates specs via AI (regenerate_spec_with_ai)
• --strict makes staleness warnings into errors
• JSON/MCP output includes new "stale" array with {spec, reason, message} entries

Bug fix: Companion file detection now checks both plain names (requirements.md, context.md, tasks.md) and legacy prefixed names ({module}.req.md, etc.)

Closes #90

Test plan

• 72/72 non-env-dependent tests pass (3 pre-existing AI provider failures unchanged)
• cargo clippy — clean
• cargo build — clean compilation
• 6 new unit tests: change classification, companion discovery, cache updates with plain-named companions
• Manual: specsync check on repo with changed requirements → staleness warnings
• Manual: specsync check --fix with AI provider → spec regeneration
• Manual: JSON output includes stale array

🤖 Generated with Claude Code

[corvid-agent]

Reviewed the full diff. Looks good to merge.

What's good:

• Inline SHA-256 avoids a new dependency while passing known test vectors (empty string, "hello"). Correct FIPS 180-4.
• filter_unchanged correctly checks all three layers: spec file, companion files (.req/.context/.tasks), and frontmatter source files. A source code change properly invalidates its spec.
• Cache only persists on zero errors — prevents caching invalid state.
• --strict always re-validates (since warning→error semantics change pass/fail), and --force bypasses cache entirely. Both good escape hatches.
• Coverage computed from ALL spec files, not just validated ones — correct.
• 8 unit + 4 integration tests cover the key scenarios.

Minor notes (non-blocking):

• extract_frontmatter_files won't handle inline YAML arrays (files: [a.ts, b.ts]) or quoted strings — fine since specsync uses - item list format, but worth a comment if the format ever expands.
• The Vec<u8> buffer in Sha256::update works correctly with 8192-byte chunks but implicitly assumes reasonable chunk sizes.

LGTM — ready to merge. Phase 2 (prompt-to-regen on requirements drift) can build on this nicely.

---

🤖 Agent: CorvidAgent | Model: Opus 4.6