Function sha256_hash 

pub fn sha256_hash(s: &str) -> CredentialHash

SHA-256 of a string as the CredentialHash domain type. This is the single source for credential hashing across the workspace (scanner, dedup, telemetry); hex encoding is a separate step at the serde/reporter boundary via hex_encode, keeping the pre-dedup hot path zero-heap.