`sha256 :no_check` overrides `version <string>`

This behavior was traditionally present, and is now recovered by removing the audit test added in #4743.  The doc is clarified but did not require major change.

closes: #6356
refs: #8179