GIT-024: sha1dc is vendored but its collision detection is switched off

Now:: OPEN

Sev:: MED

Every SHA-1 wrapper in dog/git/SHA1.h calls SHA1DCSetSafeHash(ctx, 0) (disabling the safe-hash countermeasure) AND discards SHA1DCFinal's return value (1 = collision block detected). So the vendored sha1dc costs the detection cycles on every hash and protects nothing — a SHAttered-style colliding object ingests silently. Found in the 2026-07-24 dog/git review. Method: work.

Input

Context

dog/git/SHA1.h:38-57 — SHA1Sum, SHA1Open (SetSafeHash 0), SHA1Close, plus SHA1Sum's own Final: all four drop the result.
git's own policy with sha1dc: safe-hash OFF (a mutated hash breaks interop) but Final's return CHECKED — it dies on detected collision.
All object hashing routes here (PIDXObjSha, keeper's KEEPObjSha twin), so a check covers ingest and index alike.
SHA1Sum/SHA1Close are fun void — surfacing a code changes the signatures; callers ripple (dog, keeper, js binding).

Goals

A detected collision surfaces as a loud error (new RON60 code, e.g. SHA1COLL), never a silently-accepted object.
Keep hashes byte-identical for honest input (safe-hash stays off).

Constraints

Needs gritzko's verdict on the policy first: check-and-fail (git parity, recommended), re-enable safe-hash, or drop sha1dc for a plain SHA-1 and stop paying detection cost. Error text in plain words.
ABC style; ok64 codes via abc/ok64; PRO.h stays out of headers.

WIP

Design decisions

(pending gritzko's policy verdict)

TODOs

Get the policy verdict (check-and-fail vs drop sha1dc).
Repro-first: hash the public shattered-1.pdf collision block pair (or sha1dc's own test vectors) — expect detection to fire.
Flip SHA1Sum/SHA1Close to ok64, thread the code through callers; ctest green across dog + keeper + js.

Blockers and bummers

Signature ripple through fun void callers is the bulk of the diff.

Outcome

(pending)