feat: SHA-256 compatibility audit across codebase

[flyingrobots]

Motivation

CodeRabbit flagged SHA-1 hardcoding (40-char regex) in multiple places across 5 review rounds. We fixed the content module and schemas to accept {40,64}, but there may be other spots in the codebase that assume 40-char SHAs.

Scope

• Grep for /[0-9a-f]{40}/ patterns, sha.length === 40, and similar hardcoded SHA-1 assumptions
• Update to support SHA-256 (64-char) where git object hashes are used
• Verify git hash-object and git cat-file work transparently with both formats
• Update any test assertions that hardcode SHA length

Context

Git supports --object-format=sha256 in newer versions. Future-proofing now is cheap.