pub fn package_hash(dir: &Path) -> String
content hash: SHA-256 over the package’s module files in canonical path order (§8.7)