internal/pkg: update http checksum signature

This was using the old pre-KnownChecksum function signature. It did not affect correctness since httpArtifact performs internal validation to avoid the strict mode vfs roundtrip, but it prevented content-addressed cache hits.

Signed-off-by: Ophestra <cat@gensokyo.uk>

internal/pkg/net.go

@@ -32,6 +32,8 @@ type httpArtifact struct {
 	mu sync.Mutex
 }
 
+var _ KnownChecksum = new(httpArtifact)
+
 // NewHTTPGet returns a new [File] backed by the supplied client. A GET request
 // is set up for url. If c is nil, [http.DefaultClient] is used instead.
 func NewHTTPGet(
@@ -59,8 +61,8 @@ func (a *httpArtifact) Params() []byte { return []byte(a.url) }
 // Dependencies returns a nil slice.
 func (a *httpArtifact) Dependencies() []Artifact { return nil }
 
-// Checksum returns the address to the caller-supplied checksum.
-func (a *httpArtifact) Checksum() *Checksum { return &a.checksum }
+// Checksum returns the caller-supplied checksum.
+func (a *httpArtifact) Checksum() Checksum { return a.checksum }
 
 // ResponseStatusError is returned for a response returned by an [http.Client]
 // with a status code other than [http.StatusOK].