Normalize hashes, throw exception on things that aren't hashes

- normalize to the _full_ commit hashes
- hg can be extended to support custom commit identifiers - subversion IDs, differential, etc. These should be banned: some are ambiguous, others may be local-only. Generally, there's a risk of users depending on behavior that is out of our control. Possible fix: assert that original hash is a substring of the normalized hash.
