Function verify_hash_pin 

pub fn verify_hash_pin(
    manifest: &PluginManifest,
    payload: &[u8],
) -> Result<(), PluginError>

Verify a plugin’s hash-pin against the payload bytes.

The manifest’s hash field, if present, must equal blake3(payload) in hex. Returns Ok(()) if there is no pin (the manifest opted out) or if the pin matches.

Errors

Returns PluginError::HashMismatch when the pin is set and the computed hash differs.