Function allow_entry_content_fingerprint 

pub fn allow_entry_content_fingerprint(entry: &AllowEntry) -> String

Deterministic content fingerprint of an allow entry’s full state, for mutation-receipt provenance (CARGO-ALLOW-SPEC-0008 “Mutation Receipt Envelope”). The v1 canonical serialization is length-prefixed and has a fixed field order, so it is independent of Rust’s Debug formatting and platform path separators — path, glob, and selector.glob are all slash-normalized before hashing, so semantically identical entries authored on Windows and Unix fingerprint identically. The SHA-256 digest is provenance evidence, not an identity or matching key.