Function verify_payload_hash 

pub fn verify_payload_hash(
    expected_hex: &str,
    payload: &[u8],
) -> Result<(), PluginError>

Verify raw payload bytes against an externally-supplied Blake3 hex digest.

This is the primitive behind verify_hash_pin, exposed separately because the security-meaningful case is a pin that arrives from outside the artifact — a host allowlist or an install record. A digest read out of the artifact’s own embedded manifest is self-certifying: an attacker who can rewrite the payload can rewrite the digest beside it. Only an Ed25519 signature over the manifest (see verify_manifest_with_policy) makes an embedded pin trustworthy.

Errors

Returns PluginError::HashMismatch when blake3(payload) differs from expected_hex.