refactor(supervise): hash the proposed file inside Proposal.new; sha256_hex → root util

Move sha256_hex out of orchestrator/supervisor/util.py to the root
bot_bottle.util (it's a generic string hash, not supervise-specific), and have
Proposal.new take the proposed file contents and compute current_file_hash
itself instead of every caller passing sha256_hex(proposed_file).

Every call site set current_file_hash to the hash of the proposed file, and
nothing reads the field except the DB round-trip (schema + _row_to_proposal +
from_dict, all untouched), so folding the hash into the factory is
behavior-preserving and removes the boilerplate. Callers now pass just the
file; the orchestrator no longer imports sha256_hex at all.

Full unit suite green (2243).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/supervisor/types.py

@@ -15,6 +15,8 @@ import uuid
 from dataclasses import dataclass
 from datetime import datetime, timezone
 
+from ..util import sha256_hex
+
 TOOL_EGRESS_BLOCK = "egress-block"
 TOOL_EGRESS_ALLOW = "egress-allow"
 TOOL_GITLEAKS_ALLOW = "gitleaks-allow"
@@ -94,7 +96,6 @@ class Proposal:
         tool: str,
         proposed_file: str,
         justification: str,
-        current_file_hash: str,
         now: datetime | None = None,
     ) -> "Proposal":
         ts = (now or datetime.now(timezone.utc)).isoformat()
@@ -105,7 +106,7 @@ class Proposal:
             proposed_file=proposed_file,
             justification=justification,
             arrival_timestamp=ts,
-            current_file_hash=current_file_hash,
+            current_file_hash=sha256_hex(proposed_file),
         )
 
     def to_dict(self) -> dict[str, object]: