v0.79.0: escrow upload carries restic_pw_sha256 (SLICE 3 auto-confirm, agent third)

HashResticPassword = sha256 hex over the trimmed password (pinned
cross-repo vector). escrowUploadRequest gains restic_pw_sha256,omitempty
— set only when a staged password was sealed into the blob. Contract test
updated; hub mirrors next.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CHANGELOG.md

@@ -1,3 +1,19 @@
+## v0.79.0 — SLICE 3: escrow upload carries sha256 of the sealed restic password (2026-07-09)
+
+The hub-verified escrow auto-confirm chain, agent third: the escrow-create ceremony now records WHICH
+offsite repo password the blob covers — as a non-reversible sha256 (a 256-bit random secret's hash is safe
+to store/serve; the password itself is never logged or uploaded).
+
+- `internal/escrow.HashResticPassword` — the CANONICAL hasher: sha256 hex over the TRIMMED password string
+  (exactly the value `AttachResticPassword` seals into the blob). **Pinned cross-repo test vector**
+  (`TestHashResticPassword_PinnedVector`, same vector asserted in felhom-controller) so the two hashers can
+  never drift silently.
+- `cmd/felhom-agent`: `escrowUploadRequest` gains `restic_pw_sha256,omitempty` — set only when a staged
+  password was folded in (no staged file → field OMITTED → the hub stores NULL → the controller stays
+  pending; correct, the blob doesn't cover the key). `TestEscrowUploadContract` updated (the hub mirrors it
+  in the same commit-pair) + asserts the omitted-when-unstaged behavior.
+- Ceremony flow (create / self-verify / R-banner / staged-file wipe) otherwise untouched.
+
 ## v0.78.0 — fork-4 hygiene: DELETE /escrow/stage-secret (staged-secret wipe) (2026-07-09)
 
 Part of the offsite-provisioning hardening bundle (pairs with controller v0.107.0 + hub v0.39.0). The staged