fix: upgrade generateBoundary from MD5 to SHA-256 - #524

Changelog

• N/A

Summary

This pull request replaces MD5 with SHA-256 in the hook executor's boundary string generator to resolve a Snyk weak-hash finding.

Also fixes a subtle bug where the original code called MD5Hash.Sum(randomBytes) which appends the hash of empty input to randomBytes, rather than actually hashing the random bytes. The fix properly uses hash.Write(randomBytes) followed by hash.Sum(nil).

Testing

Bolt JS:

$ lack create my-app
# → Starter App → Bolt for JavaScript

$ lack run
# → Test the app and confirm the logs appear
# CTRL+C

$ lack manifest info
# → Confirm manifest appears

$ lack delete -f
$ cd ../
$ rm -rf my-app/

# Repeat for:
# → Bolt for Python
# → Deno SDK

Notes

• Boundary output changes from 32 hex chars (MD5) to 64 hex chars (SHA-256); the SDK uses substring matching so any length works

Requirements

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.