ci: publish verified release checksums

[SarthakWade]

Closes #42

Summary

• generate a SHA256SUMS manifest for the exact macOS, Linux amd64, and Linux arm64 release packages
• verify the manifest before the GitHub Release step and attach it as a fourth release asset
• document verification commands for Linux and macOS
• add regression coverage to the protocol test entry point and mark backlog item E4 complete

Safety properties

• reject malformed or oversized release versions before constructing package names
• fail closed if any required package is missing, empty, a symlink, or not a regular file
• write the manifest through a private temporary file and replace it only after all checksums succeed
• publish the completed manifest with mode 0644
• verify the completed manifest immediately before publishing
• preserve the previous manifest when preflight validation fails

Verification

• shellcheck .github/scripts/release-checksums.sh apps/headless/Tests/release-checksums.sh apps/headless/test.sh
• actionlint -color .github/workflows/release.yml
• pnpm test
• pnpm test:runtime
• pnpm --filter @headless/web lint
• pnpm --filter @headless/web build
• HEADLESS_VERSION=0.0.42 ./apps/headless/build.sh
• pnpm test:e2e:mac
• pnpm test:e2e:linux
• docker build --platform linux/arm64 --target release --build-arg HEADLESS_VERSION=0.0.42 -f apps/headless/Dockerfile.linux apps/headless
• generated and verified SHA256SUMS against release-shaped macOS, Linux amd64, and Linux arm64 archives
• regression coverage for empty, malformed, trailing-dot, and oversized versions plus manifest permissions
• git diff --check