fix: read composite zip md5s apart in diff_truth

Recalbox hashes a .zip by its members. diff_truth set that composite
against the profile's container md5 and reported neocdz.zip and
neocd.zip as mismatches. _hash_mismatch now drops it through
comparable(), the rule pair_entries and the export already apply.

scripts/truth.py

@@ -735,10 +735,13 @@ def _hash_mismatch(t_entry: dict, s_entry: dict) -> dict | None:
 
     A value shared on any field settles it: the truth holds every revision a
     core accepts, and a profile may give one revision's sha1 without its md5.
-    A hash the code does not check contradicts nothing (checked_hashes).
+    A hash the code does not check contradicts nothing (checked_hashes), and
+    a platform md5 that is a composite of a zip's members is no container
+    md5 (comparable), the rule pair_entries applies.
     """
-    from exporter.baseline import checked_hashes
+    from exporter.baseline import checked_hashes, comparable
 
+    s_entry = comparable(s_entry)
     if _hash_set(t_entry) & _hash_set(s_entry):
         return None
     t_entry = checked_hashes(t_entry) or {}

tests/test_truth_diff.py

@@ -227,6 +227,25 @@ class PlatformMultiHash(unittest.TestCase):
         self.assertEqual(pair_entries(truth, list(scraped.values())), {0: 0})
 
 
+class ACompositeZipMd5IsNoContainerMd5(unittest.TestCase):
+    """Recalbox hashes a .zip by its members. Its neocdz.zip md5 was set
+    against geolith's container md5 and reported as a mismatch the export,
+    which reads the same mark, never corrects."""
+
+    TRUTH = {"files": [{"name": "neocdz.zip", "md5": "b31a246b69493c35194fe0bac120dc37"}]}
+
+    def _scraped(self, **mark):
+        return {"files": [{"name": "neocdz.zip", "md5": "f39572af7584cb5b3f70ae8cc848aba2",
+                           **mark}]}
+
+    def test_a_composite_md5_contradicts_nothing(self):
+        self.assertEqual(_diff_system(self.TRUTH, self._scraped(zip_digest="composite")), {})
+
+    def test_a_container_md5_still_does(self):
+        result = _diff_system(self.TRUTH, self._scraped())
+        self.assertEqual([m["name"] for m in result["hash_mismatch"]], ["neocdz.zip"])
+
+
 class OnlySystemDirectoryEntries(unittest.TestCase):
     """The truth kept files read from the save, content or working directory:
     diff_truth listed Cemu's mlc01 certificates, panda3ds's seeddb.bin and