feat(release): publish SHA256SUMS and verify instructions with each release

The release job now hashes every asset it uploads (frontend.zip, the SAS 9
and Viya deployment programs, the SASjs Server bundle) into a SHA256SUMS
file with basename-only paths, and attaches it to the release alongside
the assets. The release body gains a "Verifying the download" section -
emitted by .gitea/scripts/verify-section.sh so the YAML scalar stays
clean - with the sha256sum -c command and a note on what a checksum does
and does not prove.

The upload loop is rewritten from an inline list to a bash array shared
by the hashing and upload steps, so the asset set cannot drift between
what is hashed and what is uploaded.

Simulated end to end locally (stubbed curl/jq): 8 uploads fire with
correct paths, SHA256SUMS verifies with sha256sum -c, a tampered file
fails the check, and the assembled release body keeps the existing
notes with the new section and installation footer on their own lines.

.gitea/scripts/verify-section.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Emits the "Verifying the download" section appended to every release body
+# by the "Upload assets to release" step of release.yaml.
+# Keep this text in sync with the docs page:
+#   docs.datacontroller.io/docs/downloads.md
+set -euo pipefail
+cat <<'EOF'
+
+## Verifying the download
+
+Every asset on this release is covered by the `SHA256SUMS` file. To verify a download, fetch `SHA256SUMS` from the release assets alongside the files you downloaded, then run:
+
+```
+sha256sum --check SHA256SUMS --ignore-missing
+```
+
+The command reports `OK` for each asset that matches. `--ignore-missing` lets you check just the files you downloaded rather than all of them.
+
+What this protects: a matching checksum confirms the asset is byte-for-byte the file this pipeline uploaded, guarding against corrupted or tampered downloads (mirrors, proxies, interrupted transfers). It is not a signature: the hashes travel in the same release as the files, so a compromise of the forge itself could alter both. Treat it as an integrity check, not a trust anchor.
+EOF

.gitea/workflows/release.yaml

@@ -338,23 +338,43 @@ jobs:
           RELEASE_ID=$(echo "$RELEASE_JSON" | jq -r '.id')
           RELEASE_BODY=$(echo "$RELEASE_JSON" | jq -r '.body')
 
-          # Update body (also confirms the token has contents:write on this repo)
+          # Generate SHA-256 checksums over the release assets, so downloads can
+          # be verified. The file uses basename-only paths so that a plain
+          # "sha256sum -c SHA256SUMS" works in the folder the assets were
+          # downloaded to (the upload below stores them under their basename).
+          ASSETS=(frontend.zip
+                  sas/demostream_sas9.sas
+                  sas/viya.sas
+                  sas/sasjs_server.json.zip
+                  sas/sas9.sas
+                  sas/viya_noweb.sas
+                  sas/viya_noweb.json)
+
+          : > SHA256SUMS
+          for f in "${ASSETS[@]}"; do
+            sum=$(sha256sum "$f" | cut -d' ' -f1)
+            printf '%s  %s\n' "$sum" "${f##*/}" >> SHA256SUMS
+          done
+          cat SHA256SUMS
+
+          # Update body: keep the existing notes, add a verification section
+          # ahead of the installation footer. The section text lives in a
+          # dedicated script below (.gitea/scripts/verify-section.sh) so this
+          # YAML scalar stays clean.
+          VERIFY_SECTION=$(./.gitea/scripts/verify-section.sh)
+          NEW_BODY=$(jq -n --arg body "$RELEASE_BODY" --arg verify "$VERIFY_SECTION" \
+            '$body + "\n" + $verify + "\n\nFor installation instructions, please visit https://docs.datacontroller.io/"')
           curl -k --fail-with-body -sS -X PATCH \
             -H "$AUTH_HEADER" \
             -H 'Content-Type: application/json' \
-            --data "$(jq -n --arg body "$RELEASE_BODY"$'\n\nFor installation instructions, please visit https://docs.datacontroller.io/' \
-                        '{draft:false, body:$body}')" \
+            --data "$(jq -n --arg body "$NEW_BODY" '{draft:false, body:$body}')" \
             "$BASE/releases/$RELEASE_ID"
 
           # Upload assets
           URL="$BASE/releases/$RELEASE_ID/assets"
-          for f in frontend.zip \
-                   sas/demostream_sas9.sas \
-                   sas/viya.sas \
-                   sas/sasjs_server.json.zip \
-                   sas/sas9.sas \
-                   sas/viya_noweb.sas \
-                   sas/viya_noweb.json; do
+          for f in "${ASSETS[@]}"; do
             echo "Uploading $f ..."
             curl -k --fail-with-body -sS -H "$AUTH_HEADER" "$URL" -F "attachment=@$f"
           done
+          echo "Uploading SHA256SUMS ..."
+          curl -k --fail-with-body -sS -H "$AUTH_HEADER" "$URL" -F "attachment=@SHA256SUMS"