fix(transport): serialise the export content once and pack those bytes (review 2026-10-21 04/P8a)

src/ZB.MOM.WW.ScadaBridge.Transport/Export/BundleExporter.cs

@@ -159,6 +159,10 @@ public sealed class BundleExporter : IBundleExporter
                 SaltB64: string.Empty,
                 IvB64: string.Empty);
 
+        // Review 2026-10-21 04/P8a: serialise the content graph ONCE — the same bytes
+        // seed the manifest hash and are what Pack writes (or encrypts).
+        var contentBytes = _bundleSerializer.SerializeContentBytes(contentDto);
+
         var templateManifest = _manifestBuilder.Build(
             sourceEnvironment: sourceEnvironment,
             exportedBy: user,
@@ -170,11 +174,11 @@ public sealed class BundleExporter : IBundleExporter
             // (either fresh ciphertext or the JSON it just serialized), so the
             // upstream hash here only matters for the plaintext path — Pack
             // trusts the supplied hash and the serializer is deterministic.
-            contentBytes: _bundleSerializer.SerializeContentBytes(contentDto));
+            contentBytes: contentBytes);
 
         // 5. Pack the zip; with a passphrase, Pack re-encrypts and re-stamps
         //    EncryptionMetadata (fresh salt/iv) + ContentHash.
-        var zipStream = _bundleSerializer.Pack(contentDto, templateManifest, passphrase, _encryptor);
+        var zipStream = _bundleSerializer.PackContentBytes(contentBytes, templateManifest, passphrase, _encryptor);
 
         // 6. Audit — entityId is the bundle's overall SHA-256 over the zip bytes
         //    (opaque to caller but uniquely identifies this export). Action