feat(cli): send spec and generator config digests with remote generation jobs

[adidavid014]

Description

Refs FECW-212. CLI half of signed SDK-generation provenance: when a remote generation job starts, the CLI now also sends SHA-256 digests of its inputs, so Fiddle can sign a provenance record linking the generated SDK to these exact files.

Changes Made

• startJob adds a provenance multipart part (provenance.json) next to ir / specs:

  {
    "specs": [{"path": "../openapi.yaml", "sha256": "..."}, {"path": "openapi-overlay.yml", "sha256": "..."}],
    "generatorsYml": {"path": "generators.yml", "sha256": "..."},
    "generatorConfigSha256": "...",   // sha256 of the generator's raw generators.yml entry, JSON with sorted keys
    "generatorName": "fernapi/fern-go-sdk",
    "generatorVersion": "1.64.2"
  }

• provenanceInputs.ts: hashes the spec, overrides and overlay files the generator actually uses: the generator's api override if it has one, otherwise the workspace's parsed API definition (covers api.specs, legacy api: paths and namespaces). URLs are skipped. Paths are relative to the fern/ dir.
• If computing digests fails, the job still runs without them (debug log only).
• Older Fiddle builds ignore the unknown part, so this is safe to release before Fiddle deploys.
• Unreleased changelog entry added.

Testing

• Unit tests added: provenanceInputs.test.ts (file digests, generator api override, key-order-stable config digest)
• Manual testing completed: digests in this format verified end-to-end against the Fiddle signer and a verification script (companion fern-api/fiddle PR)

Link to Devin session: https://app.devin.ai/sessions/d6f44a15e5bd4fa8839430d41ee644b6
Open in Devin Desktop: https://app.devin.ai/desktop/session/d6f44a15e5bd4fa8839430d41ee644b6?variant=devin
Requested by: @adidavid014

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[nitpickybot]

AI Review Summary

Adds a provenance part to remote generation jobs with SHA-256 digests of specs, generators.yml, and the generator config. Logic is self-contained and tested; main risks are unguarded failure of the new I/O inside startJob and the test's reliance on path.join collapsing ../.

• 🟡 2 warning(s)
• 🔵 1 suggestion(s)

Review Scope

• Mode: Full pull request
• Range: Full pull request through 796d5fcf4b73841a57be4741c9578875ad961cf5
• Current range coverage: Complete
• Cumulative pull request coverage: Complete

---

This review is complete for the current scope. Addressing all critical and warning findings above satisfies the review; suggestions are optional. Request another review only if subsequent changes introduce new behavior or materially expand the pull request's scope.

[devin-ai-integration]

✅ Devin resolved all 2 findings on 796d5fc

Fixed by Devin (2)

• Legacy specs missing from signed inputs
• Generator overrides sign the wrong specs

View all findings in Devin Review