fix(modelscope): identify a model file by hash before filename

A file was matched to its published version by comparing basenames against
each version's `stats.fileList`.  Renaming the weights — routine once a
model is filed away, and the reason the scanner records a sha256 at all —
made the match fail silently, so the file lost its example images and its
preview with no indication why.

The detail payload's `ModelInfos.safetensor.files[]` carries a real sha256
per published file, and the local hash is already on disk, so match on that
first: it is the one identifier a rename cannot invalidate.  Exact basename
and `showName` matching remain as fallbacks, and an unknown hash falls
through to them rather than giving up, so a re-encoded file still resolves.

Verified against the live repository: a renamed `c1-st1000` file with its
hash yields the c1-st1000 image, the same rename without a hash yields
nothing, and supplying c1-st2000's hash resolves to the c1-st2000 image even
when the filename claims otherwise.

docs/agent_skills.md

@@ -104,10 +104,12 @@ boilerplate README and put everything useful in `Description`, so reading only
 the README yields almost nothing.
 
 Providers opt in by overriding `ModelSource.fetch_model_card_context()`, which
-returns a `ModelCardContext`. Example images are matched to the model's
-**basename**, so each checkpoint in a collection repo gets its own images.
-Sites with no such extras inherit an empty context, and the pipeline behaves
-exactly as before.
+returns a `ModelCardContext`. The wanted file is identified by its sha256 when
+the caller knows it (the scanner already records one) and by **basename**
+otherwise, so each checkpoint in a collection repo gets its own images — and
+keeps getting them after the user renames the weights, which is the only
+identifier a rename cannot invalidate. Sites with no such extras inherit an
+empty context, and the pipeline behaves exactly as before.
 
 The README and the repository metadata describe the whole repository, not one
 file, so `execute_skill()` creates a `ModelSourceCache` for the duration of a