test(web): send reviewedSha256 in the zh post security-boundary test

The admin post route now requires the hash of the exact reviewed draft body,
so this older test was rejected with 400 before reaching GitHub. It now sends
the hash of the zh body it expects to be posted.

Evidence: web vitest 58 files / 549 passed, 0 failed; tsc --noEmit and
eslint clean.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_014ZwqatxgVFxHvovngywnks

web/lib/security-boundary-behavior.test.ts

@@ -27,6 +27,7 @@ vi.mock("@/lib/github", async (importOriginal) => {
 
 import { POST as adminPost } from "../app/api/admin/post/route";
 import { GET as publicFeed } from "../app/api/github/feed/route";
+import { reviewedBodyHash } from "./community-agent";
 import { runPrReview, runTriage } from "./community-agent-tasks";
 
 class FakeKv {
@@ -218,7 +219,12 @@ describe("public security boundaries", () => {
         cookie: "mt_sid=test-session",
         origin: "https://codewhale.net",
       },
-      body: JSON.stringify({ action: "post", draftKey: "draft:triage:42", lang: "zh" }),
+      body: JSON.stringify({
+        action: "post",
+        draftKey: "draft:triage:42",
+        lang: "zh",
+        reviewedSha256: await reviewedBodyHash("中文正文"),
+      }),
     }));
 
     await expect(response.json()).resolves.toMatchObject({ ok: true });