refactor(supervise): hash the proposed file inside Proposal.new; sha256_hex → root util

Move sha256_hex out of orchestrator/supervisor/util.py to the root
bot_bottle.util (it's a generic string hash, not supervise-specific), and have
Proposal.new take the proposed file contents and compute current_file_hash
itself instead of every caller passing sha256_hex(proposed_file).

Every call site set current_file_hash to the hash of the proposed file, and
nothing reads the field except the DB round-trip (schema + _row_to_proposal +
from_dict, all untouched), so folding the hash into the factory is
behavior-preserving and removes the boilerplate. Callers now pass just the
file; the orchestrator no longer imports sha256_hex at all.

Full unit suite green (2243).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/orchestrator/supervisor/util.py

@@ -1,14 +1,13 @@
-"""Pure supervise helpers — diff rendering and content hashing.
+"""Pure supervise helpers — diff rendering.
 
-Stateless utilities used alongside the `Supervisor` service. Kept as plain
-functions (not methods) because they carry no state and are also handy to
-callers that only need to hash or diff.
+Stateless utility used alongside the `Supervisor` service. Kept as a plain
+function (not a method) because it carries no state. (Content hashing is a
+generic helper — `bot_bottle.util.sha256_hex`.)
 """
 
 from __future__ import annotations
 
 import difflib
-import hashlib
 
 
 def render_diff(before: str, after: str, *, label: str = "config") -> str:
@@ -25,7 +24,3 @@ def render_diff(before: str, after: str, *, label: str = "config") -> str:
     if not parts:
         return ""
     return "".join(p if p.endswith("\n") else p + "\n" for p in parts).rstrip("\n")
-
-
-def sha256_hex(content: str) -> str:
-    return hashlib.sha256(content.encode("utf-8")).hexdigest()