Summary

Publishes a SHA256SUMS_{version} asset alongside each release’s binaries. Standard sha256sum format (hash + two spaces + filename) so both shasum -a 256 and sha256sum parse it.

Why

Pairs with fangorn/anvil# which:

• Adds a /runner/checksums endpoint that streams this asset
• Updates the install script to fetch the checksums and verify the downloaded binary before chmod+install

Without this, the server-side checksum verification has nothing to verify against and has to fall back to “warn and skip.”

Test plan

• cargo fmt --check, cargo clippy -- -D warnings, cargo test all pass locally
• CI’s next release will include SHA256SUMS_<version> as an asset

Refs #1