add SHA-based artifact-freshness check (#527) - #532

JINJA002: 'root_resolver.output.resolved_root_id' has can_omit_when_null=true and is not guarded. Wrap in '{% if root_resolver.output.resolved_root_id is defined %}', '{% if root_resolver.output is defined %}', or pipe through '| default(...)'.

JINJA002: 'root_resolver.output.resolved_root_id' has can_omit_when_null=true and is not guarded. Wrap in '{% if root_resolver.output.resolved_root_id is defined %}', '{% if root_resolver.output is defined %}', or pipe through '| default(...)'.

JINJA002: 'root_resolver.output.resolved_root_id' has can_omit_when_null=true and is not guarded. Wrap in '{% if root_resolver.output.resolved_root_id is defined %}', '{% if root_resolver.output is defined %}', or pipe through '| default(...)'.

JINJA002: 'scope_approvals_policy.output.max_revision_cycles' has can_omit_when_null=true and is not guarded. Wrap in '{% if scope_approvals_policy.output.max_revision_cycles is defined %}', '{% if scope_approvals_policy.output is defined %}', or pipe through '| default(...)'.

JINJA002: 'pr_remediation_policy.output.max_remediation_cycles' has can_omit_when_null=true and is not guarded. Wrap in '{% if pr_remediation_policy.output.max_remediation_cycles is defined %}', '{% if pr_remediation_policy.output is defined %}', or pipe through '| default(...)'.

JINJA002: 'evidence_floor_check.output.error_message' has can_omit_when_null=true and is not guarded. Wrap in '{% if evidence_floor_check.output.error_message is defined %}', '{% if evidence_floor_check.output is defined %}', or pipe through '| default(...)'.

JINJA002: 'evidence_floor_check.output.error_code' has can_omit_when_null=true and is not guarded. Wrap in '{% if evidence_floor_check.output.error_code is defined %}', '{% if evidence_floor_check.output is defined %}', or pipe through '| default(...)'.

JINJA002: 'open_evidence_pr.output.error' has can_omit_when_null=true and is not guarded. Wrap in '{% if open_evidence_pr.output.error is defined %}', '{% if open_evidence_pr.output is defined %}', or pipe through '| default(...)'.

JINJA002: 'compose_addendum.output.error' has can_omit_when_null=true and is not guarded. Wrap in '{% if compose_addendum.output.error is defined %}', '{% if compose_addendum.output is defined %}', or pipe through '| default(...)'.