Collapse remaining same-owner micro-helper forks

[forkwright]

Finding

A small remainder of exact/near-exact helpers is duplicated inside subsystems that already have an obvious canonical owner. None warrants a standalone issue, but leaving them untracked preserves the same one-fix-misses-one-copy failure mode at smaller scale.

This umbrella is intentionally narrow: it does not target merely similar algorithms with different semantic identities, and it does not duplicate the renderer, Paroche, or test-fixture classes tracked separately.

Verified against main 65644113e47814c87eaba14a6f322820974b8780.

Evidence

• Exousia digest formatting: crates/exousia/src/api_key.rs:25-33 and service.rs:76-84 define byte-equivalent sha256_hex functions. Both own the same SHA-256-to-lowercase-hex mechanism inside the auth subsystem.
• Cardigann whitespace normalization: crates/eksetasis/src/client/cardigann/extract.rs:147 and json_extract.rs:248 implement the same whitespace-collapse behavior under normalize_whitespace / normalize_space. json_extract.rs explicitly says it mirrors the HTML extractor so JSON and HTML fields normalize identically.
• Cardigann current-time helper: extract.rs:288 and json_extract.rs:330 separately implement the same utc_now conversion. Again the two extractors need one timestamp policy, not independent clocks.
• Exact-body scanning found additional micro-copies that are already subsumed by other audit issues rather than repeated here: renderer fingerprint/cancellation helpers fall under Converge the duplicate Archon and Syndesis renderer transports #741, Paroche XML/UUID/auth helpers under Consolidate repeated Paroche route support primitives #745, and test-only profile/pool helpers under Consolidate repeated workspace test database, HTTP, and audio fixtures #747.

Why this matters

These helpers are cheap to centralize and their consumers explicitly require identical behavior. A digest-format change, whitespace-normalization correction, or time-source policy should be transitive inside its subsystem rather than depending on a search for sibling private functions.

Capturing the remainder also prevents the larger audit issues from being closed while leaving obvious local copies immediately beside the new canonical seams.

Desired correction

Move each helper to the narrowest existing subsystem module that naturally owns it: one Exousia digest/encoding helper and one shared Cardigann extraction-support surface consumed by HTML and JSON extraction. Do not create a fleet-wide generic-utilities crate.

Done when:

• Exousia has one SHA-256 hex implementation;
• Cardigann HTML and JSON extraction share whitespace normalization and current-time acquisition;
• behavior-specific tests target the shared helper once plus extractor integration where useful; and
• a local duplicate scan finds no second same-owner implementation of these exact mechanics.