Generate and backfill release checksums

[saturnflyer]

Why

This repository has committed a checksums/ directory since 0.1.0, so consumers can verify a published gem against a hash recorded in source control.

That stopped working. Reissue's shared release workflow made checksum generation an opt-in input defaulting to off — deliberately, so repositories adopting the workflow don't start committing a checksums/ directory they never asked for:

Set generate_checksum: true to opt into checksums. It is off by default so that repositories already using this workflow do not start committing a checksums/ directory they never asked for.
— reissue SHARED_WORKFLOW_README.md

This repo had asked for it, but adopted the shared workflow (6f3f3ae, 2026-01-30) without setting the input. So 0.1.13 and 0.1.14 published with no checksum, and nobody noticed because nothing fails.

Summary

• generate_checksum: true in release.yml, so future releases record one again.
• Backfills the five published versions that have none: 0.1.3, 0.1.4, 0.1.5 (never had one) and 0.1.13, 0.1.14 (lost when generation stopped).

All 15 published versions now have a checksum.

How the backfilled values were derived

Each is Digest::SHA512.file(gem).hexdigest of the gem published to RubyGems — the same artifact and the same computation Bundler's build:checksum task performs (bundler/gem_helper.rb:105-114), matching the existing files byte for byte at 129 bytes.

Rather than assume a fetched gem reproduces the published hash, that was verified against a known-good version first:

committed: e7091d8a602dd216e947b2c0207ad663...
computed:  e7091d8a602dd216e947b2c0207ad663...
MATCH: true

0.1.12 was re-fetched from RubyGems and its SHA512 recomputed; it matches the checksum already in the repository. The same procedure produced the five backfills.

Notes

No other input from the shared workflow is needed here: ruby_version auto-detects from .tool-versions (4.0.2), working_directory defaults to ., and dry_run is a manual testing flag.

reissue/gem.rb already lists checksums among the paths reissue commits, so a newly generated checksum lands in the post-release version-bump PR without further configuration.