Add cryptographic hashing builtins (SHA-256, HMAC).

Motivation

API authentication with most production services (AWS, Stripe, webhook signature verification) requires SHA-256 hashing and HMAC computation. Without these primitives, agents cannot authenticate with external APIs.

Proposed functions

• sha256(@String -> @String) — SHA-256 hash, returned as hex string
• hmac_sha256(@String, @String -> @String) — HMAC-SHA256 with key and message

Implementation notes

Host-provided functions via wasmtime imports (not implemented in pure WASM for security and performance). Pure functions from Vera's perspective.

Dependencies

• Network access effect (<Http>) #57 (Http) — crypto is primarily needed for API authentication