#36495 base red: panic-ratchet in cmux-host updater (from #36185)

Tip red panic-ratchet (STATUS 14338): cmux-host: clippy::indexing_slicing 1 > baseline 0, clippy::string_slice 2 > baseline 0. All three sites came from #36185 (4805ae7a1a5) in cmux-tui/crates/cmux-host/src/updater.

• store::sha256_file: streams the file into the hasher with io::copy (no &buf[..n]).
• role flip log: short_hex uses str::get(..12) and logs a shorter or non-ASCII text whole (no &s[..12]).

Tests (cmux-host updater): a_log_line_shortens_a_hash_without_slicing_past_its_end, a_file_hash_covers_every_byte_past_one_read_buffer.

Changelog

none

Observed / Not run

• Observed: prepush-gate no new violations. Fleet panic-ratchet and cmux-host tests run at this head (job ids in a comment).
• Not run: no red run of the new tests on the base (the panic sites cannot trap on the validated 40/64-hex inputs; the red is the panic ratchet itself, red at 4805ae7a1a5).

Author-agent: merge-queue (cmux-orchestrator-1)