v1.0.2

Verify before you run this

curl -fsSLO https://raw.githubusercontent.com/marixdev/mpn-mail/v1.0.2/scripts/verify.sh
bash verify.sh --tag v1.0.2 --attest mpn-mail_linux_amd64   # or mpn-mail_linux_arm64

verify.sh fetches SHA256SUMS, looks up the exact entry for the
asset and compares digests. It exits non-zero, with a distinct
diagnostic, on a missing or malformed manifest, a missing entry, a
truncated download or a digest mismatch. There is no skip path and a
missing SHA256SUMS is never treated as "nothing to check".
--attest additionally checks the sigstore build provenance (needs
the gh CLI); without it, provenance is NOT checked and the script
says so rather than letting a pass imply more than it checked.

Full Changelog: v1.0.1...v1.0.2