Deps: when a hash is mandatory, and mismatches as errors #230

Part of #227. Proposal: ComlineProject/docs#163, proposals/offline/fetching.md#hashes.

A dependency's hash must be declared:

• for a registry dependency, always, since a version string can be republished;
• for a git dependency, when offline or when the root package requires hashes; otherwise today's warning stays;
• for any dependency with more than one source.

A copy whose hash doesn't match is a hard error naming where it came from, never a fallback. comline add writes the hash.