The sourceHash field is NOT a full-file xxhash64 — it is unset (0) and
must not be used to validate the source. Set by writers that validate the
source by another means (see omitSourceHash), so reader.validate() /
read({ sourceBuffer }) can fail LOUD (or skip) instead of silently
fail-closing on a real match. Backward-compatible: entries written before
this flag existed have it unset, so their sourceHash stays a real hash.
Header flags