fix(release): install.sh asset matching + SHA256SUMS + Dockerfile 1.25.12

install.sh:
- find_asset_url now matches by asset NAME (python3 JSON parse), not
  URL path — Gitea attachment URLs are opaque UUIDs that don't contain
  the tarball name. This was the root cause of the v0.12.18 install
  failure (asset existed but install.sh couldn't find it).
- find_asset_in_releases walks recent releases by asset name and
  returns both URL + version for the fallback walk.
- Handles 404 (tag without release) gracefully via fallback walk.

Dockerfile:
- golang:1.25 -> golang:1.25.12 (go.mod requires 1.25.12; the Docker
  image was using patch 0, causing `go mod download` to fail with
  "go.mod requires go >= 1.25.12 (running go 1.25.10)")

coreci.yml:
- All golang:1.25 images -> golang:1.25.12
- Release pipeline: add SHA256SUMS generation (sha256sum tarball)
- Release pipeline: attach SHA256SUMS alongside tarball
- Release pipeline: verify assets are actually attached after
  tea releases create (REQ-097 gate C-21); auto-attach via API if
  tea failed silently

release.sh:
- Add SHA256SUMS generation (sha256sum tarball > SHA256SUMS)

---ci---
project: orca
milestone: v0.12.18
phase: release-fix
status: complete
---/ci---

Dockerfile

@@ -21,7 +21,7 @@ ARG BUILD_TIME=unknown
 
 # --- Stage 1: build -------------------------------------------------------
 
-FROM golang:1.25 AS builder
+FROM golang:1.25.12 AS builder
 
 ARG VERSION
 ARG GIT_COMMIT