feat(hash): member-access names verbatim + versioned stamps (#140)

[Connorrmcd6]

Summary

Closes the member-access blind spot in the canonical hash — the shape that accounts for every reproduced miss in #77 — and ships the versioned-stamp migration any hash-recipe change needs. This is the actionable slice of #77 carved out in #140; the principled full bound/free split and its governance stay in #77.

The problem

The hash alpha-renamed every identifier to a positional placeholder, so re-pointing an anchored span at a different single-occurrence external symbol produced a byte-identical hash. check stayed green while the claim's prose became false:

edit in the anchored span	lang	before
PointsTier.TIER_1 → TIER_2	TS	green (missed)
Tiers.getHighest → getLowest	TS	green (missed)
b.Del(n) → b.Keep(n)	Go	green (missed)
ProbeColor.RED → GREEN	Python	green (missed)

What changed

• v2 recipe keeps the property/field component of a member-access expression verbatim instead of alpha-renaming it — TS property_identifier (member_expression), Go/Rust field_identifier (selector/field expression), Python the attribute name. These positions name an external member, never a local binding, so emitting them verbatim distinguishes "re-pointed at a different symbol" (loud) from "renamed my own local" (still quiet — rename tolerance preserved). v1 ≡ v2 minus this one rule: a single mode flag, no frozen copy of the old algorithm.
• Versioned stamps: stored hashes carry their recipe (2: prefix; bare hex = implicit v1). check verifies each stamp under its own recipe, so existing v1 stamps keep passing — with a one-line nudge — until surf verify re-stamps them as v2. An unrecognized prefix fails closed. Forced re-verify is deliberately avoided: it would launder real v1-missed drift green. One surf verify per repo ends the transition.
• Golden fixtures pin both recipes per language (plus member-access cases); docs/reference/hash-recipes.md documents the rules and migration.
• Dogfooded: the repo's own hubs are migrated to v2 and the affected claim prose updated; surf check is green on v2 with no nudge.

Out of scope — stays in #77

Full bound/free split for bare free identifiers; external-corpus validation harness; dogfood claims in hubs/hash.md; full version-table governance.

Verification

All gates run locally on this branch:

• cargo fmt --all --check — clean (exit 0)
• cargo clippy --all-targets --all-features -- -D warnings — clean (exit 0)
• cargo test --all — 202 passed, 0 failed across all crates
• surf check (repo dogfood) — all anchored spans match their stored hashes

New coverage: the five probes flip green→DIVERGED (v1-blind / v2-loud, all four families); rename tolerance preserved (consistent local + receiver renames stay quiet); clean-v1 nudge; changed-v1 still fails; v1→v2 verify upgrade is idempotent; unknown-version fails closed; 2: stamp YAML round-trip; member-access golden digests pinned per recipe.

Closes #140

🤖 Generated with Claude Code