Refactor: consolidate core SHA-256 digest helpers #99675

Summary

Consolidate repeated core SHA-256 digest mechanics into a focused src/infra/crypto-digest.ts owner while preserving domain-specific identifiers and compatibility-sensitive naming at call sites.

Problem to solve

Core runtime code currently repeats one-shot SHA-256 hex/base64 wrappers, prefix truncation, and streaming file hashing. The duplicate implementations make byte/string input contracts, encodings, and error behavior harder to audit consistently, and two separate skill paths maintain equivalent streaming file hashers.

Proposed solution

• Add narrow core helpers for SHA-256 hex, base64, hexadecimal prefixes, and async file hashing.
• Migrate an exact-contract core slice only.
• Preserve caller-owned names, labels, cache keys, truncation lengths, and persisted identifier formats.
• Leave multi-part namespace hashes, security protocols, non-SHA256 algorithms, packages, and plugins with their current owners.
• Add Unicode, hostile-byte, truncation, and binary-file regression coverage.

Alternatives considered

• A new dependency is unnecessary because Node's maintained node:crypto primitive already provides the required behavior.
• A shared package or plugin SDK export would broaden the API beyond the core-only owner boundary; package and plugin digest contracts should remain local until an external contract is justified.
• A repository-wide migration would mix security, protocol, and compatibility-sensitive hashes into one review and is intentionally out of scope.

Impact

Affected: core maintainers and callers using repeated SHA-256 mechanics.

Severity: maintenance and auditability improvement; no intended user-visible behavior change.

Frequency: repeated across core cache keys, redacted identifiers, artifact validation, telemetry identifiers, and persisted records.

Consequence: fewer duplicate implementations and one tested contract for exact core digest mechanics.

Evidence/examples

The ranked shared-utility inventory identifies SHA/digest wrappers and short hash presentation as consolidation targets. The selected implementation slice removes two duplicate streaming file hashers and migrates 15 core callers while reducing production LOC.