Function fetch_manifest 

pub async fn fetch_manifest(
    registry_base: &str,
    manifest_rel: &str,
    expected_sha256: &str,
) -> Result<PackManifest, PackFetchError>

Fetch a pack pack.json, verify its sha256 against the index pin, and parse it. manifest_rel is the index-declared path; expected_sha256 is the pin. Refuses to return a manifest whose bytes don’t match the pin.