fix(ci): name the CI native checksum manifest exactly SHA256SUMS

[abrichr]

What

Write and verify dist/native/SHA256SUMS in the CI native installer jobs.

Why

All four native installer jobs failed on main after #115:

error: SHA256SUMS must be inside the release asset directory
##[error]Process completed with exit code 2.

#115 hardened verify_checksums to accept only a manifest named exactly
SHA256SUMS:

if manifest.parent.resolve() != directory.resolve() or manifest.name != "SHA256SUMS":
    raise ValueError("SHA256SUMS must be inside the release asset directory")

build.yml still passed SHA256SUMS-${{ matrix.platform }}-${{ matrix.architecture }}.
The native installer matrix is skipped on pull requests and runs on main
pushes (Native installer (${{ matrix.label }}) reports skipping on every
PR), so the exact-head checks on #115 could not catch it.

How

Use the plain name. Each matrix job owns its own dist/native directory and
uploads under a distinct artifact name (native-${platform}-${architecture}),
and nothing consumed the per-platform manifest name, so there is no collision.
The hardened check is unchanged — the workflow is corrected to match it.

New test_every_workflow_checksum_manifest_uses_the_exact_name reads every
workflow file and refuses a --output or --manifest value that mentions
SHA256SUMS without ending in it. It fails against the previous build.yml, so
the contract cannot drift silently again.

Tests

• Full suite: 1028 passed.
• ruff check engine/ tests/ scripts/: passed.
• The native installer matrix itself only runs on main; the post-merge run is
  the proof.

🤖 Generated with Claude Code