ci(release): append SHA256SUMS to release notes + upload as an asset

Future releases get:
- A 'Checksums' section appended to the release body with sha256sum -c
  -compatible 'HASH  filename' lines for each .uf2 attached
- A SHA256SUMS.txt file uploaded alongside the .uf2 artifacts so users
  can verify with 'sha256sum -c SHA256SUMS.txt' after downloading

Web-config flasher already compares this against its own SHA-256 on the
'Use latest release' path, but the hashes on the release page let people
manually verify the bundled site UF2 too.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -104,11 +104,29 @@ jobs:
           cmake --build build/debug --target ds5-bridge
           cp build/debug/ds5-bridge-oled.uf2 "artifacts/ds5-bridge-oled-debug-${{ github.event.release.tag_name }}.uf2"
 
-      - name: Upload UF2 files to release
+      - name: Compute UF2 checksums + append to release notes
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          # Generate SHA256SUMS.txt next to the UF2s
+          ( cd artifacts && sha256sum *.uf2 > SHA256SUMS.txt )
+          cat artifacts/SHA256SUMS.txt
+          # Append the same hashes (markdown-formatted) to the existing release body
+          BODY=$(gh release view "$TAG" --json body --jq .body)
+          {
+            printf '%s\n' "$BODY"
+            printf '\n---\n\n## Checksums\n\n```\n'
+            cat artifacts/SHA256SUMS.txt
+            printf '```\n'
+          } > /tmp/release-notes.md
+          gh release edit "$TAG" --notes-file /tmp/release-notes.md
+
+      - name: Upload UF2 files + SHA256SUMS to release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh release upload "${{ github.event.release.tag_name }}" artifacts/*.uf2 --clobber
+          gh release upload "${{ github.event.release.tag_name }}" artifacts/*.uf2 artifacts/SHA256SUMS.txt --clobber
 
       # Notify the web config repo so its GH Pages deploy rebuilds and
       # bundles this fresh UF2 into the site. If the WEB_REPO_DISPATCH_PAT