Function sha256_hex 

pub fn sha256_hex(bytes: &[u8]) -> String

Helper: SHA-256 hash of arbitrary bytes, hex-encoded.

Exposed so callers building a ToolAuditEntry can compute arguments_hash / result_hash without pulling in sha2 directly.