Function policy_digest 

pub fn policy_digest(
    ceiling: &BTreeMap<ResourceId, ResourceCeiling>,
) -> Sha256Digest

Canonical digest of the immutable target-ceiling content, reported as policy_digest in Describe. Domain-separated from resource digests so the two never collide, even over identical inputs.