fix: prevent sha256() from throwing on statically known strings and document potential issues with runtime hashing#907