pub fn verify_binary(command: &str, expected_sha256: &str) -> Result<(), String>Expand description
Verify that command resolves to a binary whose SHA-256 equals
expected_sha256. An empty expected_sha256 means “no pin” → Ok. The
comparison is case-insensitive over hex; any mismatch, unresolved binary, or
read error is a hard failure (fail-closed — a pin you cannot check is a pin
that failed).