fn sha256_hex(digest: &[u8]) -> String
Lowercase hex digest, matching the names Conduit gives its media files.