Release artifacts need integrity verification and a build completeness guarantee

[bougyman]

No Homebrew tap exists yet (CRY-37), so the GitHub Release binaries are the primary install path for a lot of users right now, not a fallback. Two real gaps in burrito-release.yaml:

1. No completeness guarantee: mix release lc builds all 3 Burrito targets in one invocation, then gh release upload app/burrito_out/* --clobber uploads whatever exists. Burrito builds each target independently, so one target silently failing partway through wouldn't necessarily fail the whole mix release invocation - the release could ship missing a binary with no failure signal in CI.
2. No integrity verification: nothing lets a downloader confirm a binary wasn't corrupted or tampered with in transit.

Fix:

• Explicitly verify lc_linux_x86_64 and lc_macos_aarch64 exist in burrito_out/ after the build, failing the CI job loudly (::error::) if either is missing - these two are the guaranteed floor ("at least" linux-x86_64 and macOS Apple Silicon). Windows keeps building since the step already produces it for free, but isn't asserted on.
• Generate a SHA256SUMS file (sha256sum * in burrito_out/) covering every artifact that did build, uploaded alongside the binaries.
• Document verification in Readme.adoc's "Download a release binary" section - shasum -a 256 -c - on macOS (no sha256sum on stock macOS), sha256sum -c - on Linux.