We need a reliable way to check a release inventory against the artifact checksums we expected to publish. Finish the reconciler so its report clearly separates missing files, unexpected files and checksum mismatches.
Build the implementation in Go under /app, with /app/run.sh as its entry point. Read one JSON request from standard input and write one JSON result to standard output. Input has expected and observed mappings from artifact name to exactly eight hexadecimal characters. Normalize checksum case. Return sorted missing, unexpected and mismatched name lists; matching items are omitted. This task compares supplied short checksum labels and does not claim cryptographic verification. Reject malformed checksum labels in either inventory.
Reject inputs that violate an explicit validation rule with exit status 2, no standard output, and {"error":"invalid_input"} on standard error. For valid input, exit with status 0. Keep the implementation reusable for new inputs; it must work offline and must not depend on the example data being the only data it receives.
Repair or replace the unfinished /app/run.sh and add source files under /app. Malformed JSON must use the same invalid-input response. Do not read /tests or /oracle from the application.