Verify exact RV32I prebuilt contents

[thc1006]

The rolling release freshness check compare only the number of conformance ELF files. An ELF can change without changing that count, so CI may keep a stale release. Re-running the lowering checks against that release only validates the stale ELF inputs again.

Stage exactly the files included in the release and generate a sorted SHA-256 manifest for them. Verify the manifest after extraction, then compare it with the manifest generated from the current CI build. Republish the rolling release whenever a stage file is added, removed, or changes content.

make verify-prebuilt passes.
make check-all passes.

---

Summary by cubic

Adds a SHA-256 content manifest for the RV32I prebuilt and updates CI to republish only when the staged payload changes, preventing stale or partial rolling releases. The consumer now verifies the payload against the manifest; malformed or truncated releases skip instead of passing.

• New Features

  • New rv32i-release target stages only shipped files into build/rv32i-release/rv32i and writes rv32i/MANIFEST.sha256.
  • New scripts/rv32i-manifest.sh creates/verifies a canonical, sorted manifest; CI stages the tree, verifies the current release against its own manifest, compares manifests with this build, and republishes on any payload change. Self-heals missing/drifted checksums, unreadable archives, or payload/manifest mismatches. Packaging now tars from build/rv32i-release/rv32i. scripts/rv32i-prebuilt.sh verifies the manifest before lowering. README updated.

• Bug Fixes

  • Strictly validate riscv-tests/count.txt via scripts/rv32i-count.sh: single-line positive decimal, required when conformance ELFs are present, and must match the number of ELFs; reject missing/malformed/mismatched values. Tests add offline cases for bad counts and manifest mismatches (no manifest, drifted digest, extra file), and gate the full pass-case on a staged tree with a matching manifest and count.

^{Written for commit 48e50a2. Summary will update on new commits.}

[jserv]

Rebase latest main branch and resolve conflicts.

[thc1006]

Rebased onto the latest main and resolved the conflicts. The two automated review findings were also addressed: manifest hashing now fails closed for unsupported filenames or hashing errors, and the full fixture validates the staged manifest before asserting the success path.

make verify-prebuilt and make check-all pass.

[jserv]

Rebase latest main branch and drop commit "Validate RV32I prebuilt count metadata".

[jserv]

Thank @thc1006 for contributing!