Function canonical_hash_from_bytes 

pub fn canonical_hash_from_bytes(bytes: &[u8]) -> Result<String, VerifyError>

SHA-256 hex of JCS-canonical bytes, from raw input. No parse step, so fields the caller’s proto doesn’t know about are preserved in the canonical bytes - verify side computes the same hash as the producer regardless of additive proto drift.