fix(config): portable sha256 — Linux ships sha256sum, not shasum

resolve-user-slug and endpoint hashing exited 127 on Amazon Linux (shasum
is a macOS/perl tool). New _sha256_hex helper prefers sha256sum and falls
back to shasum, matching gstack-verify-gate's existing pattern; both call
sites converted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/gstack-config

@@ -192,9 +192,14 @@ lookup_default() {
 # Brain-integration helpers (T5+T10+T16)
 # ──────────────────────────────────────────────────────────────────────
 
+# Portable sha256 hex on stdin: Linux ships sha256sum, macOS ships shasum.
+_sha256_hex() {
+  if command -v sha256sum >/dev/null 2>&1; then sha256sum | awk '{print $1}'; else shasum -a 256 | awk '{print $1}'; fi
+}
+
 # Compute sha8 of a string. Used for endpoint hashing.
 sha8_of() {
-  printf '%s' "$1" | shasum -a 256 | cut -c1-8
+  printf '%s' "$1" | _sha256_hex | cut -c1-8
 }
 
 # Detect the active brain endpoint hash. Reads ~/.claude.json for the gbrain
@@ -228,7 +233,7 @@ endpoint_hash_with_collision_check() {
   _claude_json="$HOME/.claude.json"
   if [ -n "$_matching" ] && [ -f "$_claude_json" ] && command -v jq >/dev/null 2>&1; then
     _url=$(jq -r '.mcpServers.gbrain.url // .mcpServers.gbrain.transport.url // empty' "$_claude_json" 2>/dev/null)
-    _sha16=$(printf '%s' "$_url" | shasum -a 256 | cut -c1-16)
+    _sha16=$(printf '%s' "$_url" | _sha256_hex | cut -c1-16)
     # Look for any sha16-namespaced key that conflicts. If a stored sha16 exists
     # and differs from current sha16, that's the collision evidence; emit sha16.
     _stored16=$(grep -E "^(brain_trust_policy|user_slug_at)@${_sha16}" "$CONFIG_FILE" 2>/dev/null | head -1 || true)