pub fn sha256_file(path: &Path) -> Result<String>
Whole-artifact sha256 (streaming; SPEC.md C2 — cache hits are re-verified, never trusted blindly).