docs(spec): the environment artifact's checksum describe states its own coverage boundary (the metadata block only); grantedPermissions states it sits outside the digest by design (#14993) - #16008