Publish release checksums and platform trust guidance #23

Part of OpenBeat v0.1.0 public launch map.

Question

What checksum generation and signature guidance make every published release artifact independently verifiable?

Goal

Give users a straightforward way to verify downloads and understand platform security prompts.

Work

• Generate SHA-256 checksums for every release asset.
• Attach or publish a checksum manifest with the GitHub Release.
• Document checksum verification on macOS and Windows.
• Document signature verification after signing is implemented.
• Until both platforms are signed, state exactly which artifacts are unsigned and what warnings users should expect without encouraging unsafe blanket bypasses.

Acceptance criteria

Every published installer has a documented digest and signature status, with reproducible verification instructions.