P1: Include zip in SHA256SUMS.txt for releases

[Kinin-Code-Offical]

Problem

• Release SHA256SUMS.txt currently omits cloudsqlctl-windows-x64.zip, even though the zip is published as a release asset.
• This weakens release integrity checks for users/package managers (Scoop/winget/choco) that depend on the zip hash.

Acceptance criteria

• ools/stage-artifacts.ps1 writes SHA256 entries for:
• cloudsqlctl.exe
• cloudsqlctl-setup.exe
• cloudsqlctl-windows-x64.zip
• Release workflow uploads the updated SHA256SUMS.txt.

Test plan

• Run
  pm run stage and confirm �rtifacts/SHA256SUMS.txt contains a line for cloudsqlctl-windows-x64.zip.

[Kinin-Code-Offical]

Plan

• Update ools/stage-artifacts.ps1 to generate SHA256SUMS.txt after the zip is created and include both .exe and .zip entries.
• Validate locally by running:
  pm run package,
  pm run installer,
  pm run stage and confirming �rtifacts/SHA256SUMS.txt contains cloudsqlctl-windows-x64.zip.

Risk

• Ensure checksum generation stays deterministic and filenames match uploaded release assets.

[Kinin-Code-Offical]

Done via #48
Merge commit: 0b85a1d

Verification

pm run stage now writes SHA256SUMS entries for cloudsqlctl.exe, cloudsqlctl-setup.exe, and cloudsqlctl-windows-x64.zip.