fix(release): repair the Windows install path and widen arch coverage

[filipeforattini]

The Windows .sha256 sidecar was the raw three-line certutil -hashfile report, whose first whitespace-separated token is the literal SHA256:

SHA256 hash of dit-windows-x86_64.exe:
80cd9c58...155a4
CertUtil: -hashfile command completed successfully.

All three consumers read that first token as the digest, so on Windows the PowerShell one-liner, install.sh under MSYS, and dit update each abort with a checksum mismatch. This is live in v0.3.0.

Changes

Sidecar — emit one canonical <digest> <asset> shape on every runner (sha256sum → shasum → parsed certutil), and fail the build if the result is not 64 hex chars, rather than publish an unverifiable asset.

Consumers — install.ps1, install.sh and src/update.rs now scan for the first 64-char hex run instead of taking token one. Since the installers are fetched from main, this unblocks Windows against the already-published v0.3.0, no re-release needed.

Architecture coverage

• Added aarch64-pc-windows-msvc (Windows on ARM), cross-compiled from the x64 runner. Best-effort and unsmoked — it cannot be executed there.
• Promoted macos-x86_64, macos-aarch64 and windows-x86_64 out of optional: true. Each was allowed to fail silently, which is exactly how a release ships without the asset an installer resolves by name.

verify-assets gate — new job between build and publish-github. The five required assets must be present, non-empty, and match a well-formed sidecar or the release is never created; best-effort assets missing are ::warning::, not silence.

Fallbacks — all three consumers drop to the x86_64 build on Windows ARM when a release carries no native ARM64 asset.

Verification

• The verify-assets script, replayed against a fixture reproducing v0.3.0 artifacts, fails on the malformed Windows sidecar; passes once corrected; fails on a missing required asset. All three cases exercised locally.
• 4 new unit tests in src/update.rs cover canonical + legacy-certutil sidecar parsing and the fallback table — all pass.
• install.sh passes bash -n; the workflow parses as YAML with the expected 9-leg matrix.
• Not run: cargo clippy / full cargo test (deferred to CI at the requester's direction). No PowerShell available locally, so install.ps1 was reviewed but not executed.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}