#660 extension push: adversarial-review report hash is platform-dependent (macOS vs Linux), so committed reviews never match a cross-OS runner

Summary

swamp extension push computes the adversarial-review report content hash differently on macOS and Linux for byte-identical source and the same swamp version. Because the committed .swamp-reviews/ reports (located via SWAMP_EXTENSION_REVIEW_DIR) are named by that hash, reports authored on one OS never match a runner on another OS — every extension re-emits the MEDIUM adversarial-review-report warning forever.

This contradicts the documented contract for SWAMP_EXTENSION_REVIEW_DIR: "store reports in the repo so they survive across runners."

Environment

• swamp 20260615.105123.0-sha.6ace6971 (identical on both sides: local install and CI systeminit/setup-swamp stable, which resolves to that exact build).
• Local dev: macOS (darwin). CI: ubuntu-latest (linux-x86_64).
• SWAMP_EXTENSION_REVIEW_DIR set to the committed repo directory on both.

Expected

For the same extension source + manifest and the same swamp version, swamp extension push --dry-run resolves the same report hash path on any OS, so a committed review authored once is found on every runner.

Actual

The hash is platform-dependent (stable per platform, divergent across platforms). Concrete examples (same commit, same swamp version):

extension	macOS hash (committed, matches local)	linux hash (CI, all runs)
@jentz/aws-context-guard	653d054d…	ba4ad8f9…
@jentz/aws-vpc-inventory-report	dac187cf…	204d9577…

The linux hash is stable across three separate CI runs (different commits, same extension source) — it is deterministic, just different from macOS.

Not caused by bundled dependencies

@jentz/aws-vpc-inventory-report imports only npm:zod@4, and zod is the one package swamp does not bundle. It has effectively no inlined npm code, yet its hash still diverges across OS. So the divergence is in the hashing/normalization itself, not in platform-specific bundling of inlined dependencies. (Models that bundle the AWS SDK diverge too — but the zod-only report rules out "non-reproducible bundle" as the root cause.)

Impact

The committed-review workflow cannot be enforced in CI. A team that authors reviews on macOS and runs CI on Linux (or vice-versa) gets a permanent adversarial-review-report warning on every extension; turning that warning into a hard gate is impossible to satisfy without regenerating all reviews on the exact CI platform (which then breaks for every other-OS contributor).

Suggested fix

Compute the content hash over the canonical source inputs (manifest + the extension's *.ts source bytes, normalized for line endings/ordering) rather than over any platform-specific bundle or OS-normalized artifact, so the hash is reproducible across operating systems.

Repro

1. On macOS, with SWAMP_EXTENSION_REVIEW_DIR pointed at a committed review dir containing a current report, run swamp extension push <manifest> --dry-run --json — no adversarial-review-report warning.
2. Check out the identical commit on Linux with the same swamp version and the same env var; run the same command — the adversarial-review-report warning returns, and the .file path in the warning shows a different hash than the committed report.