Hash handoff: attach the digest to a specific file

A useful handoff states the artifact's filename, version or date, byte size, hash algorithm, full digest, and how the recipient should verify it. Put the expected digest in a trusted channel separate from an untrusted download when authenticity matters. Do not imply that an ordinary hash proves who created the file; that requires a trusted signature or authenticated source. If the artifact is replaced, issue a new digest and make the superseded value clear.