hammer.git: make package list formatting consistent

Reserve the 4th column for the package hash, regardless if it was a GIT
repository or a TAR ball.
hammer.git: check md5sum of downloaded TAR balls

Check md5sum of downloaded TAR balls.