Add sha256, the crypto family's intersection operator

[EvanWinget]

What changed

The sha256 operator (0x0b) lands as the intersection half of the crypto family: spec rows in VM.md and COSTS.md, the operator implementation, pinning vectors, and diff-harness coverage. The divergent half, secp_verify (D2), follows in its own PR.

Spec sections

• VM.md section 4: the 0x0b table row, the crypto family prose, and the arg_not_atom taxonomy row.
• COSTS.md section 8 (new): the cost formula, and the section 1 interleaving bullet (concat-shaped loop with a trailing malloc).
• VM.md D3: sha256 leaves the list of consensus-known opcodes BitLisp classes as unknown. No new divergence: sha256 is bit-for-bit intersection behavior.

Reading order

1. 88b30ce Spec: operator table row, family prose, cost formula, D3 update. Every claim is probe-backed against chia-rs 0.46.0 flags 0 (probe details in the commit message).
2. 5ee7f2a Implementation: op_sha256 as a concat-shaped loop, constants in costs.py.
3. 51f58b8 Vectors and harness: crypto.json (expectations produced by the oracle, not by bitlisp), generator emits 0x0b, and a harness classifier fix. The first fresh-seed run misclassified the oracle's "sha256 used on list" message through the bare InvalidOperatorArg catch-all as arg_too_long. The fix adds the sha256 fragments to both oracle tables.

Verify independently

.venv/bin/pytest python/tests
.venv/bin/python tools/run_vectors.py
.venv/bin/python tools/diff_clvm.py --count 10000 --seed <any fresh seed>
ci/lint/lint.sh

Two 10k harness runs (seeds 728281 and 314159) pass with zero failures. The vector suite is 416 cases across 9 files, 18 of them new in crypto.json.

[EvanWinget]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[EvanWinget]

Review evidence, following the post-implementation cross-check practice from PRs 7 and 8.

Five independent review passes (CLAUDE.md compliance, shallow bug scan, git history, prior-PR guidance, code-comment contracts) found no issues. Empirical checks run during review, beyond the PR's own verification:

• Every digest in crypto.json recomputed independently, and every cost recomputed from the COSTS.md section 8 formula. All 18 match.
• Exhaustive budget sweeps (every budget from 1 to cost plus 3) on eight program shapes including pair-in-first/second/third argument, improper tail, and a 300-byte atom, bitlisp versus chia-rs flags 0: zero mismatches.
• Three additional fresh harness seeds (998877, 990731, 424242) beyond the PR's two: zero failures.
• Both new classifier fragments probed against the pinned wheels: chia-rs emits "InvalidOperatorArg: sha256 used on list" and the Python oracle emits "sha256 on list", exactly the strings added, with the chia-rs entry correctly placed before the bare InvalidOperatorArg catch-all.

Upstream source cross-check (reading disclosure per the reference-material policy, behavior was established by binary probes first): clvm_rs more_ops.rs op_sha256 uses the same constants (87 base, 134 per argument, 2 per byte), accrues the base cost unchecked, runs each argument's atom check before that argument's checked charge, and charges malloc on the finalized 32-byte digest. This matches the COSTS.md section 8 formula and the op_sha256 loop shape line for line.