fix(backup): checksum is base64-of-SHA256 to match cms restore verification

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backup/archive.go

@@ -4,7 +4,7 @@ import (
 	"archive/zip"
 	"context"
 	"crypto/sha256"
-	"encoding/hex"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -100,8 +100,7 @@ func BuildArchive(ctx context.Context, w io.Writer, in BuildInput) (*Manifest, [
 	}
 
 	// Checksum of the unencrypted dump.
-	sum := sha256.Sum256(in.Dump)
-	checksum := hex.EncodeToString(sum[:])
+	checksum := computeChecksum(in.Dump)
 
 	// Encrypt the dump.
 	encryptedDump, encParams, err := EncryptWithPassword(in.Dump, in.Password)
@@ -222,3 +221,11 @@ func BuildArchive(ctx context.Context, w io.Writer, in BuildInput) (*Manifest, [
 func closeBestEffort(c io.Closer) {
 	_ = c.Close()
 }
+
+// computeChecksum calculates the SHA-256 hash of data, base64-encoded —
+// byte-identical to the cms computeChecksum so the existing cms restore path
+// (verifyChecksum) accepts archives built by this package.
+func computeChecksum(data []byte) string {
+	hash := sha256.Sum256(data)
+	return base64.StdEncoding.EncodeToString(hash[:])
+}

backup/archive_test.go

@@ -5,7 +5,7 @@ import (
 	"bytes"
 	"context"
 	"crypto/sha256"
-	"encoding/hex"
+	"encoding/base64"
 	"io"
 	"os"
 	"path/filepath"
@@ -70,7 +70,7 @@ func TestBuildArchiveRoundTrip(t *testing.T) {
 		t.Fatalf("counts: media=%d brand=%d", manifest.MediaCount, manifest.BrandCount)
 	}
 	wantSum := sha256.Sum256(dump)
-	if manifest.Checksum != hex.EncodeToString(wantSum[:]) {
+	if manifest.Checksum != base64.StdEncoding.EncodeToString(wantSum[:]) {
 		t.Fatalf("checksum mismatch")
 	}