fix(ci): harden release and deploy chain

.gitea/workflows/deploy-prod.yml

@@ -166,6 +166,38 @@ jobs:
 
           echo "✓ Downloaded: $(du -sh $ARTIFACT)"
 
+      - name: Download Release Checksum
+        run: |
+          ARTIFACT="${{ steps.fetch.outputs.artifact }}"
+          TOKEN="${{ secrets.GITEA_TOKEN }}"
+          RELEASE_TAG="${{ steps.fetch.outputs.tag }}"
+          CHECKSUM_URL="https://gitea.taxbaik.com/api/v1/repos/${{ env.REPO }}/releases/tags/${RELEASE_TAG}"
+
+          RELEASE=$(curl -sf --connect-timeout 10 --max-time 30 -H "Authorization: token $TOKEN" "$CHECKSUM_URL")
+          CHECKSUM_DOWNLOAD_URL=$(echo "$RELEASE" | jq -r '.assets[] | select(.name == "'"${ARTIFACT}"'.sha256") | .browser_download_url')
+
+          if [ -z "$CHECKSUM_DOWNLOAD_URL" ] || [ "$CHECKSUM_DOWNLOAD_URL" = "null" ]; then
+            echo "ERROR: No checksum asset found for release $RELEASE_TAG"
+            exit 1
+          fi
+
+          curl -sfL --connect-timeout 10 --max-time 120 -H "Authorization: token $TOKEN" -o "${ARTIFACT}.sha256" "$CHECKSUM_DOWNLOAD_URL"
+          test -s "${ARTIFACT}.sha256" || { echo "ERROR: checksum file missing"; exit 1; }
+          echo "✓ Checksum downloaded"
+
+      - name: Validate Release Checksum
+        run: |
+          ARTIFACT="${{ steps.fetch.outputs.artifact }}"
+          EXPECTED=$(cat "${ARTIFACT}.sha256" | tr -d '\r\n[:space:]')
+          ACTUAL=$(sha256sum "$ARTIFACT" | awk '{print $1}')
+          if [ "$EXPECTED" != "$ACTUAL" ]; then
+            echo "ERROR: Artifact checksum mismatch"
+            echo "Expected: $EXPECTED"
+            echo "Actual:   $ACTUAL"
+            exit 1
+          fi
+          echo "✓ Artifact checksum verified"
+
       - name: Setup SSH
         run: |
           mkdir -p ~/.ssh