Remove retired lock authorities

internal/config/effective_digest.go

@@ -10,7 +10,10 @@ import (
 	"gopkg.in/yaml.v3"
 )
 
-const pipelineDefaultOwnershipSource = "default"
+const (
+	pipelineDefaultOwnershipSource = "default"
+	effectivePipelineDigestVersion = "narratio-effective-pipeline-v2\n"
+)
 
 // PipelineProfileProvenance identifies the profile selected while resolving a
 // pipeline. It contains only non-secret selection metadata.
@@ -98,7 +101,8 @@ func recomputePipelineEffectiveDigest(cfg *PipelineConfig) error {
 	if err != nil {
 		return err
 	}
-	digest := sha256.Sum256(canonical)
+	digestInput := append([]byte(effectivePipelineDigestVersion), canonical...)
+	digest := sha256.Sum256(digestInput)
 	cfg.resolution.effectiveDigest = hex.EncodeToString(digest[:])
 	return nil
 }