Function is_credential_hash_disallowed 

pub fn is_credential_hash_disallowed(hash_prefix: &str) -> bool

True when FIPS mode is active and the given credential hash format is NOT on the FIPS-approved allowlist. Used by snapshot validation to reject Argon2 credential hashing (Argon2 is not FIPS-approved).

The hash argument is the stored-hash PREFIX before the colon (e.g. sha256, hmac-sha256, argon2id). When FIPS mode is disabled (OSS), always returns false (no rejection).