Resolve convert-sha256 positionals against unset fields

The previous code assigned args[0] to SourceURL and args[1] to TargetDir unconditionally, so --source-url <url> <dir> left TargetDir empty (len(args) == 1, so args[1] was never read) and failed the "requires a source URL and a target directory" check.

Consume positionals left-to-right against fields the user has not yet supplied via flags. The four flag/positional shapes (zero/one/two flags) now all yield the correct assignment. Extracted into resolveConvertSHA256Args for a unit test that covers every shape including the regression case.