Sign release checksums and harden release workflows

[DaniusKalv]

Summary

• Sign SHA256SUMS with the Kurokesu archive signing key and publish
  SHA256SUMS.asc as a release asset. The signature is verified in CI
  against the public key pinned at .github/keys/kurokesu-archive-public.asc.
• Split the release job: signing runs with a read-only token, publishing
  runs without the key.
• Harden workflow shell steps (set -euo pipefail, array-based bundling
  with empty-set guards), pin third-party actions to commit SHAs and stop
  persisting checkout credentials.

Test plan

• First tagged release: sign job verifies the signature against the
  committed public key, SHA256SUMS.asc appears in release assets.
• Verify on a clean machine: import kurokesu-archive-public.asc,
  gpg --verify SHA256SUMS.asc SHA256SUMS.