Release archives already have `.sha256` files, but the custom binary
build jobs don't put those hashes in cargo-dist's manifest. The
generated shell installer therefore has no expected archive hashes to
check.
Add a job that imports the built archives' checksums into a local
manifest before cargo-dist generates the installers. Run the helper
through uv with a script lockfile, require a valid sidecar for every
downloaded executable archive, and require the job to succeed before
hosting the release.
Zsolt Dollenstein
a592ffe132