Expect #sha256= pin in the PEP 440 hosted-get test

Since #383, a hosted scan of a requirements.txt that is not in
hash-checking mode pins the patched wheel with the url's #sha256=
fragment rather than --hash, so the PEP 440 regression test now
expects that form, matching the existing hosted pypi test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbFzTeYSTvB5iKjY6FRg7

Author: claude

crates/socket-patch-cli/tests/in_process_get_hosted_ecosystems.rs

@@ -308,7 +308,7 @@ async fn pypi_requirements_hosted_rewrites_pep440_equivalent_pin() {
         let reqs = std::fs::read_to_string(tmp.path().join("requirements.txt")).unwrap();
         assert_eq!(
             reqs,
-            format!("flask==2.0.1\nrequests @ {url} --hash=sha256:{SHA256}\n"),
+            format!("flask==2.0.1\nrequests @ {url}#sha256={SHA256}\n"),
             "{pin}: the PEP 440-equivalent pin must be redirected"
         );
         assert_no_manifest_no_blobs(tmp.path());