First consider how to find the correct way to hash any individual row from client joined with paymentinformation, then apply that to Winward's lost cvv. Consider the first entry

"1, Selie, O'Hickee, [email protected], 6412716528, 85482 8th Point, 1, jcb, 3574149894079198, 2025-09-27, 944, fd89e80a452ffd806bb39b1ee27853bf046239142057248c00cd3f6c2ce76ba9"

And Winward's entry
"628, Karney, Winward, [email protected], 5505915936, 46969 Darwin Way, 628, jcb, 3575484559870618, 2024-10-18, 111, 2c86ea0c9b64c4b85f1afc9dd25bde3cefaf297b075d51fe98e3f4685d0baa31"

We know all the columns that are possible, and the hash that should come out. Therefore, we can brute force to find what combination of columns (while maintaining order) is correct. Then after that, you can brute force which cvv Winward had (000-999). By the way, I solved these myself, but just used Gemini to produce the code for this writeup. Sorry for the poor formatting, take this and paste it into your IDE if you want to take a better look.
# Python code for getting column order

from hashlib import sha256
from itertools import combinations

data = [
"1",
"Selie",
"O'Hickee",
"[email protected]",
"6412716528",
"85482 8th Point",
"1",
"jcb",
"3574149894079198",
"2025-09-27",
"944"
]

target_hash = "fd89e80a452ffd806bb39b1ee27853bf046239142057248c00cd3f6c2ce76ba9"

def hash_combinations(data, target_hash):
"""
Hashes every possible combination of columns in the data list, stopping
when the target hash is found.

Args:
data: A list of strings representing the data columns.
target_hash: The SHA256 hash to search for.
"""
for col in data:
hashed_data = sha256(col.encode('utf-8')).hexdigest()
if hashed_data == target_hash:
print(f"Found target hash: {hashed_data} (Single column: {col})")
return

for i in range(2, len(data) + 1):
for subset in combinations(data, i):
joined_data = ",".join(subset)
hashed_data = sha256(joined_data.encode('utf-8')).hexdigest()
if hashed_data == target_hash:
print(f"Found target hash: {hashed_data} (Columns used: {', '.join(subset)})")
return

hash_combinations(data.copy(), target_hash)

This yields
Found target hash: fd89e80a452ffd806bb39b1ee27853bf046239142057248c00cd3f6c2ce76ba9 (Columns used: Selie, O'Hickee, 3574149894079198, 2025-09-27, 944)

So we need to use Winward's data in the same way.
Karney,Winward,3575484559870618,2024-10-18,111

# Python code for brute forcing the cvv

from hashlib import sha256

template = "Karney,Winward,3575484559870618,2024-10-18,"

target_hash = "2c86ea0c9b64c4b85f1afc9dd25bde3cefaf297b075d51fe98e3f4685d0baa31"

for i in range(1000):
current_string = template + f"{i:03d}"

hashed_data = sha256(current_string.encode('utf-8')).hexdigest()

if hashed_data == target_hash:
print(f"Found target hash: {hashed_data} (String used: {current_string})")
break

else:
print("Target hash not found within the specified range.")

This yields
Found target hash: 2c86ea0c9b64c4b85f1afc9dd25bde3cefaf297b075d51fe98e3f4685d0baa31 (String used: Karney,Winward,3575484559870618,2024-10-18,571)

The flag is texsaw{571}