fix(release): per-artifact checksums so a release can span hosts

build_artifacts wrote a single dist/SHA256SUMS covering whatever that host
happened to build. But a release is assembled from more than one machine — the
Linux runner cannot produce the darwin-arm64 toolchain — and
forgejo_upload_assets deliberately skips an asset whose name is already
attached. So the first host to publish wrote SHA256SUMS, and every artifact
added later was silently left uncovered by it.

Emit one <artifact>.sha256 per tarball instead. The names are unique, so each
host's contribution stands on its own and nothing goes stale.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -41,3 +41,9 @@ __pycache__/
 
 # Release artifacts produced by `x release`
 /dist/
+
+# Build/release tarballs anywhere in the tree. `git -C <repo> archive -o foo.tgz`
+# resolves -o relative to the repo, not the caller's directory, so a stray
+# archive lands in the root and a blanket `git add -A` will commit it.
+*.tar.gz
+*.tgz