Same-origin-sha256 (tier 4) against SHASUMS256.txt — no GitHub
attestations upstream. A PGP signature over the checksum file also
ships (SHASUMS256.txt.sig) but pkgwatch has no minisign/GPG verifier
yet; revisit once tier 1 lands. Tracks the glibc x86_64 Linux build.
Confirmed working end to end: check -> fetch -> verify against the
real repo (v2.1.276 at time of writing).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
