fix(adapters): crossDeviceMove verifies pre-existing target with sha256 before deleting source

With the default hash="size", a target that already existed with the same
size but different content was treated as "already copied" and the source
was deleted (data loss; REQ §2.1 cleanup needs verified import). The
pre-existing-target comparison now always uses sha256; test covers the
same-size/different-content case with default options.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

packages/adapters/src/fs/fs.test.ts

@@ -121,6 +121,10 @@ describe("moveSafe / crossDeviceMove", () => {
     expect(await readFile(t.path("src/b.mkv"), "utf8")).toBe("bbbb");
     const r4 = await crossDeviceMove(t.path("src/none.mkv"), t.path("dst/b.mkv"));
     expect(r4.status).toBe("attention");
+    // 默认 hash=size 时,已存在的同尺寸异内容目标也必须判为不一致,不得删源
+    const r5 = await crossDeviceMove(t.path("src/b.mkv"), t.path("dst/b.mkv"));
+    expect(r5.status).toBe("failed");
+    expect(await readFile(t.path("src/b.mkv"), "utf8")).toBe("bbbb");
   });
 
   it.skipIf(isRoot)("删源失败 → attention(以 root 运行时跳过:root 无视目录权限)", async () => {