pub fn load_json_policy<T: DeserializeOwned>( path: &Path, expected_sha256: Option<&str>, ) -> Result<T>
Load and parse a JSON policy file with optional SHA-256 verification.