ci(release): publish SHA256SUMS for every release asset

Let the installer verify downloads against a same-origin checksum
manifest before extract (#1267).

.github/workflows/build-release.yml

@@ -113,9 +113,26 @@ jobs:
           path: release
           merge-multiple: true
 
+      # Same-origin integrity manifest for every release asset. Hashes use bare
+      # basenames (no directory prefix) so the installer can match the file it
+      # downloaded into a temp dir. Detects corruption / single-asset swap; not
+      # a defense against a fully compromised release pipeline — that needs
+      # Sigstore / build-provenance attestation (handled separately in #1267).
+      - name: Generate SHA256SUMS
+        working-directory: release
+        shell: bash
+        run: |
+          : > SHA256SUMS
+          while IFS= read -r -d '' f; do
+            ( cd "$(dirname "$f")" && sha256sum "$(basename "$f")" )
+          done < <(find . -type f ! -name SHA256SUMS -print0 | sort -z) >> SHA256SUMS
+          echo "=== SHA256SUMS ==="
+          cat SHA256SUMS
+
       - name: Create Release
         uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
         with:
           prerelease: ${{ !startsWith(github.ref, 'refs/tags/') }}
           generate_release_notes: true
+          # release/** already includes release/SHA256SUMS generated above.
           files: release/**