Problem

hash_tree() in src/pythonnative/project/fingerprint.py decides which file changes invalidate a cached native build. Its documented contract says hashes depend on relative paths and file contents, remain stable across checkouts, and ignore build outputs and caches.

tests/test_cli.py exercises artifact reuse when a fingerprint matches, but there are no direct tests for these hashing guarantees and no tests/project/test_fingerprint.py. A regression here could trigger unnecessary native builds or reuse an outdated artifact.

Requested change

Add tests/project/test_fingerprint.py with small tmp_path fixtures that exercise the public hash_tree() helper. This is a test-only task; it doesn't require learning the Android or iOS builder.

Acceptance criteria

• Identical relative paths and bytes created in a different order under different root directories produce equal hashes.
• Changing file bytes or renaming a file changes the hash.
• Changing only a file's modification time doesn't change the hash; use os.utime() rather than sleeps.
• Adding representative ignored directories (build, __pycache__, .git) or files (.pyc, .DS_Store) doesn't change the hash, while an ordinary source file does.
• A missing root and an empty directory share the empty-tree digest; hashing a single file is also covered.

Prefer comparisons between hashes over hard-coded implementation digests. Keep the fixtures small and platform-independent; no native builds or downloads are needed.

Verification

uv run pytest tests/project/test_fingerprint.py -q
./scripts/check.sh

Suggested commit message

Following CONTRIBUTING.md:

test(project): cover deterministic native fingerprint hashing

Before starting

Please follow the issue-claiming process: check for an assignee or linked pull request, comment to claim the issue, and wait for a maintainer to assign it before opening a pull request. Contributor setup is in CONTRIBUTING.md.