Integrate deterministic release manifests into HashCheck

[BLCCoreStudio]

Summary

This consolidates the useful core direction from ReleaseSeal into HashCheck instead of keeping two checksum-oriented products permanently separate.

• adds hashcheck manifest create <MANIFEST> <FILE>...
• adds hashcheck manifest verify <MANIFEST>
• reuses HashCheck's streaming SHA-256 implementation
• generates entries in deterministic path order
• constrains manifest entries to relative paths inside the manifest directory
• rejects absolute paths and parent-directory traversal during verification
• writes manifests through temporary-file replacement
• preserves the existing v0.1.0 single-file CLI behavior
• clearly documents that manifest support is unreleased development-line functionality

Compatibility

Existing hashcheck <FILE>, --sha256, --sha512, and --expect workflows remain unchanged.

Validation

Existing CI should run format, clippy, tests, and multi-platform checks before merge.