hashes: constrain SHA-1 to WebSocket accept digests

[loadingalias]

Outcome

• expose SHA-1 only through the typed WebSocket accept-digest API
• keep the implementation no_std, allocation-free, and hardware-accelerated where supported
• restore the RunsOn cargo-graph assurance lane now that main contains the runner fix
• keep Linux cross-check regression fixtures valid on macOS Bash 3.2

Focused evidence

• cargo fmt --all -- --check
• cargo test --locked --no-default-features --features websocket-sha1 --lib --test websocket_sha1 --test websocket_sha1_allocations
• cargo run --locked --manifest-path tools/wasm-runtime-vectors/Cargo.toml
• just check-actions

The user-visible API has a reviewed .changes entry. Merge only from a current green Complete result.