pub fn hmac_sha256(key: &[u8], msg: &[u8]) -> [u8; 32]Expand description
HMAC-SHA256 (RFC 2104), hand-rolled over sha256 — for inbound webhook
signature verification (GitHub/Stripe-style X-Signature: sha256=…). Kept
dependency-free like the rest of the moat; agentd’s own outbound request
signing (RFC 9421) uses ring under --features aauth.