Lowercase-hex SHA-256 (FIPS 180-4) of a file's contents. Returns an empty string if the file can't be opened. Portable + Qt-free on purpose: the site generator links only vortex_core (no Qt / QCryptographicHash), and the update manifest it derives needs the same digest the packaging lib emits with sha256sum (plan 08). Streams the file in chunks, so large release binaries never load whole into memory.