Function verify_catalog_hash 

pub(super) fn verify_catalog_hash(
    path: &Path,
    expected_hash: &str,
) -> Result<()>

Verifies that the catalog database at path matches expected_hash.

The file is hashed with SHA-256 and compared against the expected digest in the existing verify_hash format used across the workspace.

This is the last integrity check before the refreshed catalog is finalized, so any mismatch is treated as a hard error.