F1.2: std.hash zero-heap [64]u8 hex API + chunked file + pinned vectors

Make the SHA-256 digest path allocation-free (foundation heap-discipline):

- final() and sha256_hex() now return the 64-char lowercase hex digest as
  a [64]u8 by value on the stack; the cstring(64) heap allocation is gone.
- sha256_file() streams the file in fixed 64KB stack chunks via open_file/
  File.read/File.close (defer-closed on every path) instead of slurping it
  with read_file; peak memory is O(chunk), not O(filesize).

Tests (compare via a zero-copy string view over the [64]u8):
- 0710 updated to the by-value API (output unchanged).
- 0711 known-answer vectors: "", "abc", NIST-56/112, padding boundaries
  {0,55,56,57,63,64,65,119,120}, and 1000 / 1,000,000 'a' repeats, each
  pinned to its published digest (cross-checked with shasum -a 256).
- 0712 streaming equivalence (one-shot == byte-at-a-time == split-mid-block
  == split-on-boundary) plus sha256_file(temp) == in-memory digest.

src/ untouched. zig build && zig build test && tests/run_examples.sh green.

examples/0710-modules-sha256.sx

@@ -3,15 +3,19 @@
 // Known-answer vectors (empty, "abc", the 112-byte NIST multi-block
 // vector) plus the streaming invariant: feeding the same bytes in
 // several `update` chunks yields the same digest as the one-shot call.
+//
+// The digest is a zero-heap `[64]u8` returned by value; tests build a
+// `string` view over it (no copy) to compare against the pinned hex.
 
 #import "modules/std.sx";
 #import "modules/std/hash.sx";
 
-check :: (label: string, got: string, want: string) {
-    if got == want {
+check :: (label: string, got: [64]u8, want: string) {
+    view := string.{ ptr = @got[0], len = 64 };
+    if view == want {
         print("{}: ok\n", label);
     } else {
-        print("{}: FAIL got {} want {}\n", label, got, want);
+        print("{}: FAIL got {} want {}\n", label, view, want);
     }
 }
 
@@ -31,7 +35,6 @@ main :: () {
     h.update("abcdefghbcdefghicdefghijdefghijke");   // 33 bytes
     h.update("fghijklfghijklmghijklmnhijklmno");      // crosses block edge
     h.update("ijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu");
-    streamed := h.final();
-    check("stream-eq-oneshot",
-        if streamed == sha256_hex(multi) then "yes" else "no", "yes");
+    check("stream-eq-oneshot", h.final(),
+        "cf5b16a778af8380036ce59e7b0492370b249b11e8f07a51afac45037afee9d1");
 }