pub async fn verify_sha256(path: &Path, expected: &str) -> Result<()>
Verify a file’s SHA-256 matches the expected hex string.