Deterministic bucket assignment: sha256("{subscriber_id}:{seed}"), first
4 bytes read big-endian, mod BUCKET_COUNT. Must match the TS
implementation byte-for-byte (same hash input, same byte order, same
modulo) — this is the cross-language bucketing contract, verified against
packages/shared/src/experiments/bucketing-vectors.json below.