Release artifacts: publish checksums.txt, and make --version correct under `go install`

[cloudmanic]

Summary

Every time we publish a new version of the Harbor CLI, we upload binaries but no way for
anyone to check that the file they downloaded is the file we uploaded. This issue adds that
checksum file, and fixes a related annoyance: if you install the CLI with go install, it
reports its version as dev instead of the real version number.

Nothing user-visible changes yet. This is the groundwork the Homebrew formula and the one-line
installer both need — neither of them can verify a download until this exists.

Details

Repo: HarborMyNotes/harbor-cli. Everything here is in
.github/workflows/release.yml and cmd/root.go.

Background — how releases work today

.github/workflows/release.yml runs on every push to main. It auto-increments the patch
version from the latest vX.Y.Z tag, builds five binaries, tags, and creates a GitHub release:

dist/harbor-darwin-amd64
dist/harbor-darwin-arm64
dist/harbor-linux-amd64
dist/harbor-linux-arm64
dist/harbor-windows-amd64.exe

It then seds the new version into Formula/harbor.rb and pushes that back to main.
Current release: v0.1.26 (2026-08-06).

Task 1 — publish checksums.txt with every release

Add a step after Build binaries and before Create GitHub Release that produces a
SHA-256 manifest over dist/, and include it in the release's uploaded files:.

• Filename: checksums.txt (this exact name — the formula in the sibling issue and
  install.sh in the harbor.my issue both hardcode it).
• Format: standard sha256sum output, one line per binary, bare filenames, no dist/
  prefix, so that sha256sum -c checksums.txt works from a directory of downloaded assets:

  9f2c…  harbor-darwin-amd64
  a71b…  harbor-darwin-arm64
  …
  

  Generate it from inside dist/ (e.g. cd dist && sha256sum * > checksums.txt) rather than
  stripping the prefix afterwards.
• On macOS runners sha256sum may be absent, but this job runs on ubuntu-latest, so
  sha256sum is fine. Do not switch the runner.
• checksums.txt must be uploaded as a release asset, reachable at
  https://github.com/HarborMyNotes/harbor-cli/releases/download/<tag>/checksums.txt.

Task 2 — asset names are now a public contract

Two other things will hardcode these five filenames: the Homebrew formula and
https://harbor.my/install.sh. Add a comment block at the top of the build step saying so.

If you ever rename a release asset, you must update both consumers in the same change.
Renaming an asset silently breaks every existing install script in the wild.

Task 3 — make --version correct under go install

cmd/root.go:38 currently reads:

var version = "dev"

and cmd/root.go:71 passes it to Cobra's Version. The release workflow injects the real
value via -ldflags "-X github.com/HarborMyNotes/harbor-cli/cmd.version=${VERSION}", so
release binaries are correct — but go install github.com/HarborMyNotes/harbor-cli@latest
(which we document at harbor.my/content/developers/cli.md) does no such injection and yields
dev.

Fix: when version is still the dev sentinel, fall back to the module version Go embeds in
the binary via runtime/debug.ReadBuildInfo():

• Read info.Main.Version. For a go install pkg@vX.Y.Z build this is the real tag.
• For a local go build in a working tree it is typically (devel) — keep reporting dev in
  that case rather than printing (devel).
• Keep the -ldflags path as the primary source; the build-info read is only a fallback, so
  release binaries behave exactly as they do today.
• Put this in a small documented helper in cmd/root.go (this repo comments every function,
  public and private — match that).

Task 4 — do not let the version bump race the release

Not a required change, just a caution for whoever is in this file: the workflow pushes a
formula bump commit back to main. That push uses GITHUB_TOKEN, so it does not re-trigger
the workflow. If you switch to a PAT or a deploy key, you will create an infinite release
loop. Leave a comment saying so.

Note the formula-bump step itself is being moved to a different repo by the sibling issue
(#CLI2). Coordinate: whoever lands second removes the now-dead sed/commit/push block from
this workflow.

Acceptance criteria

• Every new release has a checksums.txt asset alongside the five binaries.
• Downloading all five binaries plus checksums.txt into one directory and running
  sha256sum -c checksums.txt reports OK for all five.
• checksums.txt contains bare filenames with no dist/ path prefix.
• A binary built by the release workflow reports the tagged version from harbor --version
  (unchanged behaviour, verified not regressed).
• go install github.com/HarborMyNotes/harbor-cli@v0.1.27 (or later) produces a binary
  whose harbor --version prints that version, not dev and not (devel).
• A plain go build in a local checkout still reports dev.
• go test ./... -count=1 passes.
• A comment in release.yml records that the five asset names are a public contract
  consumed by the Homebrew formula and harbor.my/install.sh.

Screenshots

None — this is release tooling with no UI. Evidence is the sha256sum -c output and
harbor --version, both of which are acceptance criteria above.

Dependencies

Blocks #85 — the formula needs checksums.txt to pin a sha256.
Blocks HarborMyNotes/harbor.my#49 — install.sh verifies its download against
checksums.txt.

Part of HarborMyNotes/harbor-project-manager#5