ci: verify goreleaser split checksums by recompute-and-compare

[dougmartin]

Problem

On the v0.0.1-test4 release run, every build succeeded (including signed + notarized macOS binaries), but the publish job failed at Verify checksums:

shasum: cc-data_0.0.1-test4_darwin_amd64.tar.gz.sha256: no properly formatted SHA checksum lines found

goreleaser's checksum.split: true writes one file per artifact whose entire content is the bare sha256 hash (64 hex chars, no filename, no newline):

74d2cd62f6730d8972f1786edd912eba0587d340cb237c48d867ada56b60c595

shasum -c expects HASH␠␠FILENAME lines and rejects the bare-hash format, so verification always failed.

Change

• release.yml: the Verify checksums step now recomputes each tarball's sha256 and compares it to the value in its .sha256 file, instead of shasum -c. It still fails closed on a missing artifact or any mismatch.
• release_test.go: TestChecksumVerifyHandlesSplitFormat guards against reintroducing shasum -c.

The Homebrew formula render is unaffected: render-formula.sh computes hashes directly from the tarballs, not from these files.

Testing

• YAML validates; guard tests pass.
• Ran the new verify loop against the three real artifacts downloaded from the failed test4 run: all three match (exit 0).
• Will confirm a fully green publish (GitHub release + formula push) with a fresh v0.0.1-test5 tag after merge.