Should the Drupal 8 sites/default/files/config folder be stored in git with its hash suffix?
In the site install process, Drupal will write the configuration directory path to settings.php.
Any other deployments of the site would then make use of the directory defined in settings.php.
The hash itself is not information that needs protection, but it helps make the configuration harder to find in case it were not properly protected from public access.
If you're making your entire configuration public in a repository, it is important to check that it does not contain any compromising information (e.g. API keys).




The configuration should be protected by .htaccess (which core does by default) if it is in a publicly accessible directory, making it impossible to read and not just difficult to find.

It is possible to move the sync directory to another location.
Pantheon places it in sites/default/config, with an .htaccess file to protect it.
Alternately, setting up your repository so that Drupal is not in the root folder (as Acquia does) will allow creating a configuration directory that is outside of the document root.

/
|-- docroot
|    |-- core
|    |-- modules
|    |-- ...
|
+-- config
     +-- sync