pub fn sha256_jcs<T: Serialize>(payload: &T) -> Result<String>
Hex SHA-256 of JCS-canonical bytes; binds evidence_snippet to its envelope.