fix(viewer): make sources compatible with the pending dependency majors [issue:#473]

[tcballard]

Summary

Unblocks the two red Dependabot PRs, #473 (rust-dependencies) and #436 (npm-dependencies). Each fix compiles on both the current and the bumped dependency versions, so it can land first and the Dependabot branches then rebase onto it.

Adds:

• test(release): the test oracles hex-encode sha2 digests byte-wise (iter().map(|b| format!("{b:02x}"))) instead of using format!("{:x}", digest). sha2 0.11's hybrid-array digest no longer implements LowerHex, which is the chore(deps): bump the rust-dependencies group across 1 directory with 7 updates #473 compile error at decided/tests/federation_graph_support/mod.rs:212. Six call sites across four test files. sha2 is a dev-dependency only; the engine uses its own rac_engine::sha256.
• fix(viewer): ListViewProps.searchRef is typed Ref<HTMLInputElement> instead of RefObject<HTMLInputElement>. Under React 19 types, useRef<HTMLInputElement>(null) returns RefObject<HTMLInputElement | null>, which is the chore(deps): bump the npm-dependencies group across 1 directory with 10 updates #436 tsc error at App.tsx:181. Ref<T> accepts the ref under both the React 18 and React 19 definitions; RefObject<T | null> does not compile on 18.

Scope

Included

• Source compatibility fixes only. No dependency, lockfile or behaviour change.

Excluded

• The dependency bumps themselves, which stay in chore(deps): bump the rust-dependencies group across 1 directory with 7 updates #473 and chore(deps): bump the npm-dependencies group across 1 directory with 10 updates #436.

Verification

Ran

• sha2 0.10 (main): cargo test --release -p decided --test spec_bundle --test spec_federation --test point_in_time_federation -p decided-mcp --test spec_federation passes.
• sha2 0.11 (main + chore(deps): bump the rust-dependencies group across 1 directory with 7 updates #473 merged + this fix): cargo test --workspace --release gives 524 passed and 0 failed. cargo fmt --all --check is clean and cargo clippy --workspace --all-targets --release -- -D warnings is clean.
• React 18 deps (main lockfile): npm ci && npx tsc -b && npm test && npm run build && npm run build:viewer succeed, with 18/18 tests passing.
• React 19 / TypeScript 7 / Vite 8 / Vitest 5 (chore(deps): bump the npm-dependencies group across 1 directory with 10 updates #436 lockfile + this fix): the same commands succeed, with 18/18 tests passing.

Covered

• Reproduced both original failures first: the chore(deps): bump the rust-dependencies group across 1 directory with 7 updates #473 LowerHex error from its CI log, and the chore(deps): bump the npm-dependencies group across 1 directory with 10 updates #436 TS2322 error locally on its lockfile.

Review Path

1. rac-localview/src/viewer/ListView.tsx
2. The four Rust test files

---

Generated by Claude Code