Release flow bugs

[sgammon]

There are some bugs in the release pipeline which are aggravating and should eventually be fixed, to avoid the need to download artifacts and re-upload them to the release on GitHub.

• Certain hashlocks come through as 0-length
  This seems to happen only on macOS builds. Upon release, I download the artifacts and fix this myself.

• GPG signing in CI
  GPG signing is not currently wired into CI, so this is also performed manually.

• Redundant archive entries
  The main hashlock-dev-all artifact, which is used to perform releases, includes both the binaries and their compressed archives. We shouldn't include both because it is wasteful and it makes the archive 250MB, which is slow to download.

• Filename alignment
  The executables, as built during the standalone build, come out as hashlock.linux-amd64 (i.e. suffixed by their platform). Hashlocks are captured at this stage, so the subject file name ends up being hashlock.linux-amd64 within the hashlock files. When we re-package these bins to a single archive per platform, the suffix is dropped, but the hashlocks are not updated.