pub fn normalize_sha256(value: &str) -> Option<String>
Normalize SHA-256 manifest values to lower-case hex. Rejects anything other than exactly 64 ASCII hex characters.