clawdhub update reports local changes for unmodified skills (resolve API always returns match: null)

Bug Description

After installing a skill with clawdhub install --force or doing a clean install, subsequent clawdhub update <skill> calls always report "local changes detected, use --force to overwrite" even when the skill content has not been modified.

Steps to Reproduce

1. clawdhub install find-skills-skill --force
2. clawdhub update find-skills-skill
   • Expected: "already up to date" or update available
   • Actual: "local changes detected, use --force to overwrite"

Root Cause Analysis

The resolve API endpoint (/api/v1/resolve?slug=<slug>&hash=<hash>) always returns match: null regardless of the hash value passed.

• Hash of freshly downloaded zip (computed client-side): c3520b857ec64c505246f003f956fab2c76a693bdeb28f77f07af6a251a52061
• API response: {"match":null,"latestVersion":{"version":"1.0.0","createdAt":"..."}}
• Same response for deliberately wrong hashes: {"match":null,...} (no error, same structure)

The resolve API does not appear to be performing hash matching at all.

Environment

• clawdhub version: 2.3.1
• Node.js version: v22.x
• OS: Linux
• Skill affected: find-skills-skill v1.0.0, multi-search-engine-simple v1.0.0

Start with the clawdhub update flow and the /api/v1/resolve?slug=<slug>&hash=<hash> endpoint described in the report. Reproduce the request with both the downloaded hash and a deliberately wrong hash, then trace the resolve implementation to restore hash matching; done means unchanged skills report up to date while changed skills still require --force.