fix(sdk): reject overlong pubkeys in add/remove member builders

[sanjay3290]

Problem

build_add_member and build_remove_member validate target_pubkey with check_hex_len(s, 64, ...). That helper is a minimum-length check:

fn check_hex_len(s: &str, min_len: usize, field: &str) -> Result<(), SdkError> {
    if s.len() < min_len || !s.chars().all(|c| c.is_ascii_hexdigit()) {

So a 65-or-more character hex string passes validation and is written straight into the p tag. Every other pubkey site in builders.rs uses check_pubkey_hex, which is the exact-length check (s.len() != 64) and returns the value lowercased. These two builders are the only ones that reached for the git-object helper instead.

check_hex_len also returns SdkError::InvalidDiffMeta, which is the wrong variant for a member operation — check_pubkey_hex returns InvalidInput.

Change

Use the existing check_pubkey_hex in both builders and take the normalized value it already returns, replacing the separate to_ascii_lowercase() call at the tag site. No new helper, no behaviour change for valid 64-char input.

Tests

Three tests in the existing mod tests:

• build_add_member_rejects_overlong_pubkey — a 65-char pubkey now returns InvalidInput; fails on main.
• build_remove_member_rejects_overlong_pubkey — same for remove.
• add_remove_member_lowercases_pubkey — an uppercase 64-char pubkey still lands lowercased in the p tag, so the normalization is not lost in the swap.

Verification

cargo fmt --all -- --check              # clean
cargo clippy --workspace --all-targets -- -D warnings   # clean
cargo test -p buzz-sdk                  # 265 passed, 0 failed