fix(golden): make zip-artifact hashing OS-deterministic for package pins

Real `sam package` zips the build artifact directory before "uploading"
it. The harness's S3Uploader.upload stub was hashing the resulting zip
bytes — but raw zip bytes embed OS-specific metadata (DOS timestamps,
Unix mode bits, central directory ordering), so the same source content
produced different digests on Linux vs Windows. The Windows runner saw
the package pins regenerate with new hashes and the corpus tests failed
on byte-exact diff:

    -    CodeUri: s3://golden-bucket/dd2bf2d8...
    +    CodeUri: s3://golden-bucket/1c1f1e20...

Hash zip files via a normalized representation: sorted member names plus
each member's content sha256. The envelope metadata is excluded from the
digest, so identical source content produces an identical hash on every
OS. Non-zip artifacts continue to be hashed by raw bytes. Detection uses
zipfile.is_zipfile so .jar / .war and other zip-format artifacts are
treated the same as a Lambda zip.

Pins regenerated once with the new hash; from now on Linux and Windows
runners agree.

Author: bnusunny

tests/golden/harness.py

@@ -34,6 +34,7 @@
 
 import hashlib
 import os
+import zipfile
 from pathlib import Path
 from tempfile import TemporaryDirectory
 from typing import Any, Dict, Optional, Tuple
@@ -140,12 +141,48 @@ def _fake_s3_upload(self: S3Uploader, file_name: str, key: Optional[str] = None)
     URIs, but identical content always produces the same URI. The bucket
     name is fixed to :data:`GOLDEN_BUCKET` regardless of the uploader's own
     bucket attribute so pinned outputs do not depend on local config.
+
+    Zip files (the common artifact shape `sam package` uploads) are hashed
+    over a normalized representation — sorted member names plus each
+    member's content sha256 — instead of the raw zip bytes. Raw zip bytes
+    embed OS-specific metadata (DOS timestamps, Unix mode bits, sometimes
+    path separators) which would otherwise produce different digests on
+    Windows vs. POSIX runners.
     """
-    with open(file_name, "rb") as f:
-        digest = hashlib.sha256(f.read()).hexdigest()
+    digest = _hash_zip_normalized(file_name) if _looks_like_zip(file_name) else _hash_raw_bytes(file_name)
     return f"s3://{GOLDEN_BUCKET}/{digest}"
 
 
+def _looks_like_zip(file_name: str) -> bool:
+    """True if ``file_name`` looks like a zip-format artifact."""
+    try:
+        return zipfile.is_zipfile(file_name)
+    except OSError:
+        return False
+
+
+def _hash_raw_bytes(file_name: str) -> str:
+    with open(file_name, "rb") as f:
+        return hashlib.sha256(f.read()).hexdigest()
+
+
+def _hash_zip_normalized(file_name: str) -> str:
+    """Hash a zip file by its sorted member names + per-member content hashes.
+
+    This skips the zip envelope metadata (DOS timestamps, Unix permission
+    bits, central directory ordering) that varies by OS and makes raw
+    byte-level hashes non-deterministic across runners.
+    """
+    hasher = hashlib.sha256()
+    with zipfile.ZipFile(file_name, "r") as zf:
+        for name in sorted(zf.namelist()):
+            hasher.update(name.encode("utf-8"))
+            hasher.update(b"\x00")
+            with zf.open(name) as member:
+                hasher.update(hashlib.sha256(member.read()).digest())
+    return hasher.hexdigest()
+
+
 def _fake_s3_upload_with_dedup(
     self: S3Uploader,
     file_name: str,

tests/golden/templates/language_extensions/foreach_static_zip/expected.package.yaml

@@ -6,7 +6,7 @@ Resources:
     - Beta
   - ${WorkerName}Function:
       Properties:
-        CodeUri: s3://golden-bucket/dd2bf2d87ad97f55f64a8691a0e0c55ec010e7791d6815e0c0f0037348b8d5db
+        CodeUri: s3://golden-bucket/b38f16354b937b1d3c3d74e0c9d24ab809eee8b0622ec5b6408fee535b822d42
         Handler: app.handler
         Runtime: python3.11
       Type: AWS::Serverless::Function

tests/golden/templates/packageable_resources/lambda_function_zip/expected.package.yaml

@@ -6,7 +6,7 @@ Resources:
     Properties:
       Code:
         S3Bucket: golden-bucket
-        S3Key: 7187d20310f5514ad6d32ad02c3f6a8200a0b82949bcb4c63a751bc4ce730095
+        S3Key: 22186578b8d9d69e7157330653df80d6801d2e1bc7af9c2a7622640de339ae63
       FunctionName: hello
       Handler: app.handler
       MemorySize: 128

tests/golden/templates/sam_resources/serverless_function_zip/expected.package.yaml

@@ -4,7 +4,7 @@ Resources:
     Metadata:
       SamResourceId: HelloFunction
     Properties:
-      CodeUri: s3://golden-bucket/7187d20310f5514ad6d32ad02c3f6a8200a0b82949bcb4c63a751bc4ce730095
+      CodeUri: s3://golden-bucket/22186578b8d9d69e7157330653df80d6801d2e1bc7af9c2a7622640de339ae63
       Handler: app.handler
       MemorySize: 128
       Runtime: python3.11