Release archive extraction lacks per-member checksum manifest validation

[Widthdom]

Summary

The install.sh script verifies sha256sums.txt before extraction (line 737-749), but checksums only cover the downloaded archive files and sha256sums.txt itself. After tar xzf on Linux/macOS (line 756), there is no validation that the extracted payload matches expected contents or hasn't been silently truncated/corrupted by a partial tar write or file-system error. On Windows paths using Compress-Archive / Expand-Archive equivalents, the same gap exists with no detection of partial ZIP extraction failures.

Where

• .github/workflows/release.yml:205 — tar czf creates archive with no digest of members
• .github/workflows/release.yml:212 — Compress-Archive creates ZIP with no member digest
• install.sh:756 — tar xzf extracts but does not validate payload integrity
• install.sh:829-832 — File copy loop assumes all extracted files are intact

Suggested approach

1. Generate a manifest file during archive creation (e.g., MANIFEST.sha256) listing each member file path and its sha256
2. Include the manifest in both tar.gz and ZIP archives
3. After tar/zip extraction in install.sh, parse manifest and verify each extracted file against its recorded sha256
4. Fail loudly if any member is missing, truncated, or does not match; report the file path and expected vs actual hash
5. Document the manifest approach in release-changelog.md so maintainers re-run prepare without forgetting archive validation
6. Add a shell test to install.sh --self-test-local-mirror that simulates a partial tar extract and confirms detection

[Widthdom]

Work started on branch fix-issue2040-2041-2012.