pub fn workload_digest(bytes: &[u8]) -> String
Non-cryptographic content fingerprint for workload/dependency ids; not anonymization. This is NOT a cryptographic authenticity check. Caches must be in a trusted user directory.