Validate tracked release checksum manifest

tests/run-all.sh

@@ -142,5 +142,43 @@ if errors:
 print("SECRET_GUARD_OK=1")
 PY_SECRET_GUARD
 
+echo
+echo ">>> Checksum manifest"
+
+if [[ ! -f checksums/SHA256SUMS ]]; then
+    echo "ERROR: checksums/SHA256SUMS is missing" >&2
+    exit 1
+fi
+
+if grep -Eq '\.pre-|\.new($|[[:space:]])' checksums/SHA256SUMS; then
+    echo "ERROR: checksum manifest contains development artifacts" >&2
+    exit 1
+fi
+
+while read -r expected file; do
+    [[ -n "${expected:-}" && -n "${file:-}" ]] || continue
+
+    if [[ ! -f "$file" ]]; then
+        echo "ERROR: checksum target is missing: $file" >&2
+        exit 1
+    fi
+
+    actual="$(sha256sum "$file" | awk '{print $1}')"
+
+    if [[ "$actual" != "$expected" ]]; then
+        echo "ERROR: checksum mismatch: $file" >&2
+        echo "  expected=$expected" >&2
+        echo "  actual=$actual" >&2
+        exit 1
+    fi
+
+    if ! git ls-files --error-unmatch "$file" >/dev/null 2>&1; then
+        echo "ERROR: checksum manifest references untracked file: $file" >&2
+        exit 1
+    fi
+done < checksums/SHA256SUMS
+
+echo "CHECKSUM_MANIFEST_OK=1"
+
 echo
 echo "ALL_TESTS_PASS=1"