ci: verify relayed GitHub asset digests

[ZhiXiao-Lin]

Summary

• wait for every uploaded compatibility asset to expose its GitHub sha256: digest
• require each relayed digest to match the canonical source bytes before publishing

A3S 0.10.8 reads this GitHub digest directly, so byte-for-byte download verification alone is not sufficient.

Validation

• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/relay-monorepo-release.yml
• extracted workflow shell programs and validated them with bash -n
• git diff --check