refactor(supervise): hash the proposed file inside Proposal.new; sha256_hex → root util

Move sha256_hex out of orchestrator/supervisor/util.py to the root
bot_bottle.util (it's a generic string hash, not supervise-specific), and have
Proposal.new take the proposed file contents and compute current_file_hash
itself instead of every caller passing sha256_hex(proposed_file).

Every call site set current_file_hash to the hash of the proposed file, and
nothing reads the field except the DB round-trip (schema + _row_to_proposal +
from_dict, all untouched), so folding the hash into the factory is
behavior-preserving and removes the boilerplate. Callers now pass just the
file; the orchestrator no longer imports sha256_hex at all.

Full unit suite green (2243).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/util.py

@@ -5,11 +5,17 @@ level deeper, under their backend package."""
 
 from __future__ import annotations
 
+import hashlib
 import ipaddress
 import os
 import sys
 
 
+def sha256_hex(content: str) -> str:
+    """Hex SHA-256 of a UTF-8 string."""
+    return hashlib.sha256(content.encode("utf-8")).hexdigest()
+
+
 def is_ip_literal(value: str) -> bool:
     try:
         ipaddress.ip_address(value)