Keep cold Candidate verification cooperative with controller renewals

src/execution-world/artifacts.ts

@@ -1,6 +1,13 @@
 import { createHash } from "node:crypto";
 import { canonicalJson } from "../capability-model/evolution.js";
-import { type ExecutionPlan, type PlanPackage, ExecutionPlanError, hexDigest, executionVersions } from "./plan.js";
+import {
+  type ExecutionPlan,
+  type PlanPackage,
+  ExecutionPlanError,
+  hexDigest,
+  hexDigestAsync,
+  executionVersions,
+} from "./plan.js";
 
 export interface ArtifactFile {
   path: string;
@@ -359,7 +366,7 @@ export async function checkExecutionWorld(
 ): Promise<CheckedWorld> {
   if (canonicalJson(plan.definition.versions) !== canonicalJson(executionVersions))
     fail("world", "Unsupported plan codec versions");
-  if (hexDigest(plan.definition) !== plan.digest) fail("plan", "Plan digest mismatch");
+  if ((await hexDigestAsync(plan.definition)) !== plan.digest) fail("plan", "Plan digest mismatch");
   const manifests = inputs.map(parsePackageArtifacts);
   unique(
     manifests.map((m) => m.packageRevisionId),