Make the release manifest cover every published binary asset

Problem

The v0.0.92 GitHub release publishes four platform archives, but release-manifest.json lists only the two macOS archives.

Published assets:

• craft-darwin-arm64.zip
• craft-darwin-x64.zip
• craft-linux-x64.zip
• craft-windows-x64.zip
• release-manifest.json

Manifest assets:

• craft-darwin-arm64.zip
• craft-darwin-x64.zip

Linux and Windows therefore have no manifest size/checksum record. The current verify-release job checks presence of darwin-arm64, darwin-x64, and linux-x64, but omits windows-x64 and does not compare the manifest to the release asset set.

Release: https://github.com/craft-native/craft/releases/tag/v0.0.92 Manifest commit: 186cd83

Likely cause

Each platform matrix leg runs the Pantry Publish & Release action from its own local zig-out tree. The final manifest can reflect only the artifacts visible to whichever leg writes it, rather than a collected cross-platform asset set.

Expected

• Generate the release manifest after all platform artifacts have been collected.
• Include every distributed platform archive exactly once with its final byte size and SHA-256.
• Make verify-release require Windows as well as the Pantry-installable set, and fail when manifest names, sizes, or digests do not match release assets.
• Keep the manifest tag and commit checks tied to #272.

Discovered during the post-merge release audit for #254, #242, and #220.

Missing v0.0.92 manifest entries, verified from the final downloaded assets:

• craft-linux-x64.zip: size 5,278,891 bytes; SHA-256 a5c64e2b225a7a14e58ddb69f9d4fa61851b77ab170b659a546e20486812ba5d
• craft-windows-x64.zip: size 5,374,241 bytes; SHA-256 9ed650d769a15e2f31c83dd6d1ada3e9455f1724bcaff00902e2cd5396c239bc

Both archives contain the expected single platform binary (craft: stripped x86-64 ELF with executable mode; craft.exe: x86-64 PE console executable), and both binaries embed version 0.0.92. These exact records are what the current manifest omits.

The matrix overwrite cause is now confirmed by release timestamps and logs:

• Linux and Windows archives were uploaded at 15:37:46–15:37:48Z.
• The Darwin matrix leg later generated a new manifest from only its two local files at 15:42:17Z (Generated release-manifest.json for 2 artifact(s)) and uploaded/replaced it at 15:42:24Z.
• GitHub’s independent assets[].digest values match all four locally recomputed SHA-256 values, so a final aggregation job can build the complete manifest directly from the collected release assets/digests.

This is deterministic last-writer behavior, not a missing-hash calculation.