claude-config: state-key.sh no-hash-tool error path exits inside a command substitution, so the script continues and emits a malformed key at exit 0

[kyle-sexton]

Context

Found by the repo-wide /code-tidying:batch-simplify sweep (62 groups / 986 files, branch claude/repo-code-tidying-batch-twhddw). The sweep's doctrine files latent defects instead of fixing them mid-sweep, because the fix changes observable behavior; this issue is that filing.

plugins/claude-config/lib/state-key.sh:110-122 — when neither sha256sum nor shasum exists, exit 2 fires inside identity="local/$(hash12 ...)", killing only the subshell. Under the script's set -uo pipefail (no -e) execution continues and prints a key with empty hash/discriminator segments (local//<disc>) at exit 0, contradicting the header's "cannot derive a state key" contract. Canonical sync source for six plugins — a fix must go through the sync engine and bump all consumers.

Proposed work

• Move the tool check out of the command substitution (probe before assignment) so the documented exit 2 actually terminates the script.

Acceptance criteria

• On a PATH with no sha256sum/shasum the script exits 2 with the documented error and prints no key; sync copies updated via scripts/sync-state-key.sh.

References

• plugins/claude-config/lib/state-key.sh:110-122
• scripts/sync-state-key.sh

Filed by the /code-tidying:batch-simplify closeout (Phase 8).