refactor(supervise): hash the proposed file inside Proposal.new; sha256_hex → root util

Move sha256_hex out of orchestrator/supervisor/util.py to the root
bot_bottle.util (it's a generic string hash, not supervise-specific), and have
Proposal.new take the proposed file contents and compute current_file_hash
itself instead of every caller passing sha256_hex(proposed_file).

Every call site set current_file_hash to the hash of the proposed file, and
nothing reads the field except the DB round-trip (schema + _row_to_proposal +
from_dict, all untouched), so folding the hash into the factory is
behavior-preserving and removes the boilerplate. Callers now pass just the
file; the orchestrator no longer imports sha256_hex at all.

Full unit suite green (2243).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_orchestrator_control_plane.py

@@ -28,7 +28,6 @@ from bot_bottle.orchestrator.store.store_manager import StoreManager
 from bot_bottle.orchestrator.supervisor import (
     Proposal,
     TOOL_EGRESS_ALLOW,
-    sha256_hex,
     Supervisor,
 )
 
@@ -420,7 +419,7 @@ class TestDispatchSupervise(unittest.TestCase):
             "10.243.0.1", metadata=json.dumps({"slug": slug}), policy="routes: []\n")
         p = Proposal.new(
             bottle_slug=slug, tool=TOOL_EGRESS_ALLOW, proposed_file=proposed,
-            justification="need it", current_file_hash=sha256_hex(proposed))
+            justification="need it")
         Supervisor().write_proposal(p)
         return p.id