Expose promoted template content digests

[CMGS]

Summary

• compute one canonical SHA-256 identity over the regular-file export produced by Promote
• persist the digest with the exact published generation and return it from Promote and promoted-template Claim
• expose the identity through the Go and Python SDKs
• keep generation selection exact across supported shared backends: striped cross-process flock for shared directories, retained immutable S3 generations, and retryable exports-first S3 deletion

Integration

This closes the mutable-template identity gap identified while reviewing cocoonstack/instar#4 and the T11 item in cocoonstack/instar#1. Instar can pin and compare the digest returned by the exact Claim generation instead of trusting a reusable template name.

Validation

• make go-test
• make go-lint
• python -m pytest -q: 137 passed
• python -m ruff check .
• asl ./store/...
• git diff --check

Boundary

Existing templates have an empty digest until they are promoted again. Shared directory stores must provide cross-node POSIX flock, and S3 keeps superseded generations until Delete under the existing single-writer-per-id contract. This PR does not add a template registry, version API, or claim-time full rehash.