[rbardaji]

Refs #373. Checksums are done; signing is left open until an organization key is decided.

What

• Release assets. scripts/build_installer_asset.py <tag> <dir> writes install.sh and SHA256SUMS, and the release workflow attaches both to every release with gh release upload --clobber.
  • The asset is install/install.sh of the tag with exactly one line set: INSTALLER_RELEASE="<tag>". So the downloaded installer installs its own release instead of the newest one.
  • The order of precedence is --ref, then EP_REPO_REF, then the embedded release, then the latest release.
  • The build refuses a non-release tag, and refuses an installer without the marker line.
• State. INSTALLER_SHA256, the checksum of the installer that ran, is recorded in .env.install-state.
• Docs. The verifying one-liner is documented: download both files, run sha256sum -c SHA256SUMS, then bash install.sh. The docs also say what the checksum does and does not protect against.

Not in this PR

Signatures (GPG, minisign or cosign) need a private key held by the organization as a repository secret. That decision is open, so this PR does not close #373.

Tests

• New tests/test_build_installer_asset.py.
• Two new tests in install/tests/test_default_release_ref.py (an asset installs its own release; --ref still wins), plus the INSTALLER_SHA256 check.
• 10 of the new tests fail on main.
• Real test: the asset built for v0.34.63 passed sha256sum -c, cloned v0.34.63 and installed an Endpoint that answered healthy.
• After the tag, the real assets of v0.34.64 will be downloaded, verified and installed.

Release 0.34.64.