pub fn sha256_file(path: &Path) -> VtaResult<String>
Stream a file through SHA-256, returning lowercase hex.