feat: Publish and verify SHA-256 checksums for standalone Hive CLI archives

Thank you for maintaining the Hive CLI.

The documented installer currently downloads a platform archive from `cli.graphql-hive.com` and extracts it without verifying a publisher-provided checksum or signature. Downstream consumers that pin the CLI therefore have to download each archive, calculate their own hashes, and trust that initial download. Which is a bit of a charade, which is the reason for this request.

Would you consider generating a `SHA256SUMS` manifest during the existing release workflow, covering all supported archives, and publishing it at:

Plain text

```
https://cli.graphql-hive.com/versions/VERSION/SHA256SUMS
```

It would also be helpful for `install.sh` to verify the selected archive before extraction.

Publishing the archives and checksum manifest on the corresponding GitHub release would provide a separate, discoverable source for downstream package definitions and pinned installations. As a further improvement, immutable releases and GitHub artifact attestations or Sigstore signing could bind the artifacts to the release workflow and source commit.

Publisher-generated hashes would be a useful first step and remove the need for consumers to establish their own trust-on-first-use pins.

Would this fit Hive’s current release model?

Start with install.sh and the existing release workflow described in the issue, then trace how standalone archives are published at cli.graphql-hive.com. Done means a SHA256SUMS manifest covers all supported archives, is available under each VERSION and on the corresponding GitHub release, and install.sh verifies the selected archive before extraction.

Written by the indexing model from the issue text.