pub fn encode_sha256_hex(digest: &[u8; 32]) -> String
Encode a raw 32-byte digest in the repository-wide wire form "sha256:" + lowercase_hex(...) (RFC-ACDP-0012 §2).
"sha256:" + lowercase_hex(...)