Adjacent work: PDF receipts, encrypted blob+share mock, NATS tunnel, SHA256 Zapier action

Around remaining blockers (Zapier login, live Verae): generate PDF receipts
without extra deps; AES-256-GCM object store with tenant isolation and share
tokens; scripts/nats-tunnel.sh to NS1; SHA256 Hash Text local Zapier action;
scripts/test-offline.sh for the no-login suite.

Learned: other-tenant object GET is 403; share token is the mock unwrap path.

packages/verae-activate/index.js

@@ -10,6 +10,7 @@
 const authentication = require('./authentication');
 const addNumbers = require('./creates/add_numbers');
 const echo = require('./creates/echo');
+const sha256Hash = require('./creates/sha256');
 
 module.exports = {
   version: require('./package.json').version,
@@ -18,5 +19,6 @@ module.exports = {
   creates: {
     [addNumbers.key]: addNumbers,
     [echo.key]: echo,
+    [sha256Hash.key]: sha256Hash,
   },
 };