pub(crate) fn sha256_file(path: &Path) -> Option<String>Expand description
Hex SHA-256 of a captured PNG, recorded in the audit trail so a leaked
screenshot can be traced back to the call that produced it (spec §6).
Best-effort — a hashing failure yields None and must never fail the
capture, matching audit_log_capture_window’s own “never break the tool”
discipline.