fix(release): clean release assets + SHA256SUMS URL lookup fix

SHA256SUMS

@@ -1 +1 @@
-9fa21a416801ef88e52d8f07b5406752f56a3f07ca8d758e445ba5f3a2fce055  orca-v0.12.18-linux-amd64.tar.gz
+d3e91c4b932a96a31d1ca1b805f24b42d23c6e26e63f2c28d7c7798321eb31fe  orca-v0.12.18-linux-amd64.tar.gz

scripts/install.sh

@@ -201,9 +201,27 @@ info "downloading..."
 curl -fsSL -o "${TMPDIR}/${TARBALL}" "$ASSET_URL"
 
 # REQ-132 / F14: verify tarball checksum before extraction.
-# Fetch SHA256SUMS from the same release; fail closed on mismatch.
-SHA256SUMS_URL="$(dirname "$ASSET_URL")/SHA256SUMS"
-if curl -fsSL -o "${TMPDIR}/SHA256SUMS" "$SHA256SUMS_URL" 2>/dev/null; then
+# Fetch SHA256SUMS from the same release. For Gitea release-download
+# URLs (e.g. /releases/download/vX.Y.Z/...) the SHA256SUMS is a sibling.
+# For Gitea attachment URLs (e.g. /attachments/<uuid>) we must look up
+# the SHA256SUMS asset by name from the release API.
+SHA256SUMS_URL=""
+if echo "$ASSET_URL" | grep -q "/releases/download/"; then
+  SHA256SUMS_URL="$(dirname "$ASSET_URL")/SHA256SUMS"
+elif command -v python3 >/dev/null 2>&1; then
+  # Look up SHA256SUMS asset by name from the release API.
+  SHA256SUMS_URL="$(curl -fsSL \
+    "${GITEA_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/releases/tags/${VERSION}" 2>/dev/null \
+    | python3 -c "
+import json,sys
+r=json.load(sys.stdin)
+for a in r.get('assets',[]):
+    if a.get('name')=='SHA256SUMS':
+        print(a.get('browser_download_url',''))
+        break
+" 2>/dev/null || true)"
+fi
+if [ -n "$SHA256SUMS_URL" ] && curl -fsSL -o "${TMPDIR}/SHA256SUMS" "$SHA256SUMS_URL" 2>/dev/null; then
   info "verifying checksum..."
   (cd "$TMPDIR" && grep -F "$TARBALL" SHA256SUMS | sha256sum -c -) || {
     err "checksum verification failed (REQ-132); refusing to install"