Add SHA256 checksums to releases

[EDsCODE]

Summary

• Generates checksums.txt with SHA256 hashes for all binaries
• Uploads checksums file to both versioned and latest releases

Enables checksum verification when downloading, e.g., with Ansible:

- name: Download checksums file
  get_url:
    url: "https://github.com/PostHog/duckgres/releases/latest/download/checksums.txt"
    dest: /tmp/duckgres-checksums.txt

- name: Get checksum for arm64 binary
  shell: grep 'duckgres-linux-arm64' /tmp/duckgres-checksums.txt | awk '{print $1}'
  register: duckgres_checksum

- name: Download duckgres binary with checksum verification
  get_url:
    url: "https://github.com/PostHog/duckgres/releases/latest/download/duckgres-linux-arm64"
    dest: "{{ duckgres_install_dir }}/duckgres"
    checksum: "sha256:{{ duckgres_checksum.stdout }}"

Test plan

• Verify checksums.txt is generated and uploaded to release

🤖 Generated with Claude Code