ENH: v4 sanitize plugs ghostflow gaps for hash sidecars and *~ artifacts

Two ghostflow-check-main violations slipped through v4 sanitization on
TextureFeatures ingest (PR InsightSoftwareConsortium#6238):

1. .sha512 / .cid content-link sidecars without trailing newline.
   is_skip_content() returned True for any single-line hex hash blob,
   bypassing apply_universal_text_fixers (and therefore fix_end_of_file).
   Hash content has zero risk from the universal fixers (rstrip + single
   '\n' append), so drop the hex-hash skip branch and let those blobs
   flow through the normal text-fixer path.

2. Editor backup files (*~) survived ingestion. Adds **/*~ to the
   filter-repo --invert-paths deny-pass alongside *.orig / *.rej /
   *.BACKUP.* / *.LOCAL.* / *.REMOTE.* / *.BASE.*.

Documented both in INGESTION_STRATEGY_v4.md's sanitizer table.

Author: hjmjohnson

Utilities/Maintenance/RemoteModuleIngest/INGESTION_STRATEGY_v4.md

@@ -275,7 +275,8 @@ by the v4 sanitizer; operators do not need to fix them by hand:
 | `cmake_minimum_required(VERSION X.Y.Z)` line at the top of an ingested module's `CMakeLists.txt` | `sanitize-history.py:patch_drop_cmake_minimum_required` | ITK's top-level CMakeLists pins a higher minimum; per-module declarations are redundant and frequently **lower** than the ITK floor (3.10.2 is common upstream). (@dzenanz, PR #6215 IOFDF) |
 | `README.rst` references in CMake `file(READ ...)` calls | `sanitize-history.py:patch_readme_reference` | Phase B archival promotes `MIGRATION_README.md` to `README.md`; in-tree consumers read the markdown form |
 | `get_filename_component(...) / file(READ README.md DOCUMENTATION)` preamble + `DESCRIPTION "${DOCUMENTATION}"` in `itk-module.cmake` | `sanitize-history.py:patch_dynamic_description` | Archival `README.md` contains semicolons and `[` characters that CMake list expansion splits into spurious `itk_module()` arguments, producing `CMake Warning (dev): Unknown argument` on every configure (observed: RLEImage, SplitComponents, IOFDF, IOMeshMZ3, IOMeshSTL; fixed in ITK PR #6220) |
-| `*.orig`, `*.rej`, `*.BACKUP.*`, `*.LOCAL.*`, `*.REMOTE.*`, `*.BASE.*` | deny-pass | Leftover merge-conflict artifacts |
+| `*.orig`, `*.rej`, `*.BACKUP.*`, `*.LOCAL.*`, `*.REMOTE.*`, `*.BASE.*`, `*~` | deny-pass | Leftover merge-conflict artifacts and editor backup files |
+| `.sha`, `.sha512`, `.cid` content-link sidecars missing trailing newline | `sanitize-history.py:apply_universal_text_fixers` (via `fix_end_of_file`) | ghostflow-check-main rejects commits with EOF-newline-missing in any text blob, including hash sidecars; the universal text fixers preserve hash content and append the missing `\n` (observed: TextureFeatures PR #6238) |
 | Scaffolding (`Dockerfile*`, `azure-pipelines*.yml`, `.github/`, `.travis.yml`, `.circleci/`, `tox.ini`, `pyproject.toml`, `setup.py`, `.clang-format`, `.pre-commit-config.yaml`, …) | deny-pass | Module's per-repo CI/packaging is irrelevant in-tree |
 
 Each sanitizer prints a `<count> patches` line in the run summary so

Utilities/Maintenance/RemoteModuleIngest/ingest-module-v4.sh

@@ -246,6 +246,7 @@ info "Running scaffolding deny-pattern strip pass..."
     --path-glob '**/*.LOCAL.*' \
     --path-glob '**/*.REMOTE.*' \
     --path-glob '**/*.BASE.*' \
+    --path-glob '**/*~' \
     --path-glob '**/.ExternalData_*' \
     --path-glob 'LICENSE' \
     --path-glob 'LICENSE.*' \

Utilities/Maintenance/RemoteModuleIngest/sanitize-history.py

@@ -232,13 +232,12 @@ def is_binary(head: bytes) -> bool:
 
 
 def is_skip_content(data: bytes, head: bytes) -> bool:
-    """Return True for content that should be left untouched (CID/sha
-    content-links, VTK volumes, SVG, etc.)."""
+    """Return True for content that should be left untouched (VTK volumes,
+    SVG, etc.).  Hash sidecar files (.sha / .sha512 / .cid) are NOT skipped
+    — they need universal text fixers so the hash gets a trailing newline,
+    which ghostflow-check-main rejects when missing."""
     if any(s in head[:512] for s in SKIP_HINTS):
         return True
-    # Single-token hex hash file (CID content-link sidecar)
-    if data.count(b"\n") <= 1 and HEX_HASH_RE.match(data.strip()):
-        return True
     return False