fix(ci): harden release and deploy chain

.gitea/workflows/prepare-release.yml

@@ -154,6 +154,14 @@ jobs:
           echo "✓ Package: $(du -sh $ARTIFACT | cut -f1)"
           file "$ARTIFACT"
 
+      - name: Generate Artifact Checksum
+        run: |
+          VERSION="${{ steps.metadata.outputs.version }}"
+          ARTIFACT="quantengine_${VERSION}.tar.gz"
+          sha256sum "$ARTIFACT" | awk '{print $1}' > "${ARTIFACT}.sha256"
+          echo "✓ Checksum created: ${ARTIFACT}.sha256"
+          cat "${ARTIFACT}.sha256"
+
       - name: Create Git Tag
         run: |
           VERSION="${{ steps.metadata.outputs.version }}"
@@ -207,6 +215,16 @@ jobs:
 
           echo "✓ Artifact attached: $ARTIFACT"
 
+          echo "Uploading checksum..."
+          curl -sf -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: multipart/form-data" \
+            -F "attachment=@${ARTIFACT}.sha256" \
+            "${API}/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${ARTIFACT}.sha256" \
+            -o /dev/null
+
+          echo "✓ Checksum attached: ${ARTIFACT}.sha256"
+
   notification:
     name: Release Notification
     runs-on: ubuntu-latest