JJ versus Git diff hashes

Trap: comparing a frozen plain Jujutsu diff hash with git diff --no-color --no-ext-diff looks like candidate-integrity verification, but the serializers produce different bytes for the same unchanged patch. Fix: freeze and compare the exact command and serialization format; when formats differ, verify both hashes against the same immutable base/head rather than treating the mismatch as drift.