Fix: authenticate release verification and emit valid checksums

[0xLeif]

Summary

• reuse checkout-managed credentials for the post-publication tag fetch
• remove the duplicate hand-built Authorization header
• generate checksum sidecars without stripping the digest
• verify every generated sidecar before release publication
• strengthen regression coverage for authentication and SHA-256 content

Root causes

The final verification step retained a command-scoped Authorization header after the other release fetches moved to checkout-managed credentials. Separately, checksum generation passed ./asset through a greedy sed expression, which stripped the digest and left only the filename. The prior negative shell assertion used ! grep under set -e, which did not terminate the script when the forbidden pattern was present.

Test Plan

• fledge run release-provenance-test
• fledge run release-distribution-test
• fledge lanes run verify (11 steps, 266 tests)

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.