pub fn checksum(content: &str) -> String
SHA-256 hex digest of a string, used for lock-file invalidation.