feat(ci): add release manifest verification

.gitea/workflows/prepare-release.yml

@@ -162,6 +162,30 @@ jobs:
           echo "✓ Checksum created: ${ARTIFACT}.sha256"
           cat "${ARTIFACT}.sha256"
 
+      - name: Generate Release Manifest
+        run: |
+          VERSION="${{ steps.metadata.outputs.version }}"
+          COMMIT="${{ steps.metadata.outputs.commit }}"
+          ARTIFACT="quantengine_${VERSION}.tar.gz"
+          CHECKSUM=$(cat "${ARTIFACT}.sha256")
+          python3 - <<PY
+          import json
+          import pathlib
+
+          payload = {
+              "version": "${VERSION}",
+              "commit": "${COMMIT}",
+              "artifact": "${ARTIFACT}",
+              "sha256": "${CHECKSUM}",
+          }
+          pathlib.Path("${ARTIFACT}.manifest.json").write_text(
+              json.dumps(payload, ensure_ascii=False, indent=2),
+              encoding="utf-8",
+          )
+          PY
+          echo "✓ Manifest created: ${ARTIFACT}.manifest.json"
+          cat "${ARTIFACT}.manifest.json"
+
       - name: Create Git Tag
         run: |
           VERSION="${{ steps.metadata.outputs.version }}"
@@ -225,6 +249,16 @@ jobs:
 
           echo "✓ Checksum attached: ${ARTIFACT}.sha256"
 
+          echo "Uploading manifest..."
+          curl -sf -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: multipart/form-data" \
+            -F "attachment=@${ARTIFACT}.manifest.json" \
+            "${API}/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${ARTIFACT}.manifest.json" \
+            -o /dev/null
+
+          echo "✓ Manifest attached: ${ARTIFACT}.manifest.json"
+
   notification:
     name: Release Notification
     runs-on: ubuntu-latest