The manifest generator now hashes each installer (SHA-256) so the
website download page can display verifiable checksums, and accepts an
optional pub-date argument. The sync-to-r2 job passes the release's
actual publishedAt instead of relying on generation time, which drifted
for backfills.
Add a sync-to-r2 job that downloads the published release assets,
generates the website download manifest, uploads both to the
cc-switch-releases bucket (dl.ccswitch.io), and prunes versions
beyond the latest five. The job skips itself when R2 secrets are
not configured, so forks and the current pipeline are unaffected.
Jason