ci: emit Windows checksum manifests with LF

[roy2392]

Closes #588

Summary

Windows release checksum files were written with PowerShell Out-File, which emits CRLF. Unix shasum -c / sha256sum -c then treats the filename as ending in \r and fails.

This writes the .sha256 manifest with explicit LF (no BOM), rejects a CR on the Windows builder, and adds a Unix-side sha256sum --strict -c gate before the GitHub release is published. The same write path is fixed in the edge workflow.

v0.10.0 assets are left alone; this applies to subsequent releases only.

Test plan

• Windows package step writes omnigraph-windows-x86_64.sha256 without CR
• sha256sum --strict -c on ubuntu accepts the Windows manifest (and the Unix ones)
• CI on this PR is green
• Do not republish v0.10.0

Greptile Summary

The PR fixes Windows checksum manifests to use LF without a BOM and adds a release-time portability and checksum-integrity gate before publication.

• Uses an explicit UTF-8-no-BOM writer for Windows checksum manifests in stable and edge workflows.
• Rejects carriage returns immediately on Windows.
• Verifies all stable-release manifests and referenced archives with GNU sha256sum --strict.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness, security, or workflow issues identified.

The Windows writer produces a GNU-compatible checksum line with an explicit LF and no BOM, while the stable release gate verifies colocated manifests and archives before publication.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Writes the Windows checksum manifest portably and verifies all downloaded release manifests before publishing.
.github/workflows/release-edge.yml	Applies the same LF-only, no-BOM checksum-manifest write and CR guard to edge releases.

_{Reviews (1): Last reviewed commit: "ci: emit Windows edge checksum manifests..." | Re-trigger Greptile}