A colleague confirmed. What's going on?
I get the correct hash on linux using sha256sum.
Edit: You may need to pass -b (--binary). The man page[0] says it defaults to "text mode," whatever that means (this SO question[1] for md5sum suggests it has to do with how it opens the file, which apparently makes no difference on Linux/Windows but maybe it does on Mac?)
[0]: https://ss64.com/mac/shasum.html [1]: https://unix.stackexchange.com/q/127959