SHA-256 over raw asset bytes and over the canonical JSON form of
metadata (encoding/json already sorts map keys and preserves struct
field order deterministically, so no separate canonicalization library
is needed for our own fixed types). A Timestamper interface stands in
for the RFC-3161 timestamp step — no concrete implementation yet, since
which TSA to use is an open decision (CLAUDE.md "Offene Punkte") that
directly affects the archive's evidentiary weight, not a purely
technical choice to make silently.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
