feat(crypto): add owned incremental SHA-256 contexts

[sanohiro]

Large-file hashing needs bounded retained state across input chunks. Add crypto.sha256_stream() -> crypto.digest, nonretaining exclusive update, and consuming finish returning an owned 32-byte array. The opaque Move owner participates in recursive cleanup, borrowed helpers, generic/interface transport, checked HIR, MIR producer validation, and runtime ABI identity.

Includes the align-llm product-boundary assessment and the reviewed R29 implementation ledger. The filesystem, host, process-containment, and borrowed-slice capabilities remain separate work in that plan; consumer adoption remains align-llm-owned.

Validation:

• Whole/per-unit digest and existing asymmetric owners pass. Generated code creates 15 contexts and releases all 15; removing an early-exit Drop makes the same owner fail.
• Native vectors, malformed-input subprocesses, provider-failure cleanup, canonical codecs, malformed HIR/MIR, ABI declarations, and runtime exports pass.
• Fixed-chunk storage measurement retains one context through 64 MiB input.
• Bounded gate and workspace library/binary Clippy pass. Independent full-diff review found two P2 issues, both closed in one fix commit.