wbox self upgrade reads wrong checksum manifest filename

[massive-value]

Problem

src/wealthbox_tools/self_upgrade.py reads the checksum manifest as checksums.txt, but .github/workflows/release-binaries.yml (PR #63) ships the manifest as SHA256SUMS.txt. Result: wbox self upgrade will 404 on the manifest fetch against any real GitHub Release, so the happy path from #32 (PR #65) doesn't actually work end-to-end against published artifacts.

Surfaced independently by both agents implementing #42 (PR #75) and #43 (PR #74), who chose to follow the workflow contract (SHA256SUMS.txt) rather than mirror the existing client code, and flagged the divergence.

Decide which name wins

SHA256SUMS.txt is the more conventional choice (matches the sha256sum output format, used by countless CLI projects). The workflow already produces it. Proposal: rename the constant in self_upgrade.py to match. Alternative: change the workflow to also produce checksums.txt, but renaming is one fewer artifact and fewer moving parts.

Modules touched

• src/wealthbox_tools/self_upgrade.py — rename the manifest filename constant from checksums.txt to SHA256SUMS.txt.
• tests/test_self_upgrade.py — update any test fixtures that reference the old name.

Acceptance criteria

• wbox self upgrade requests SHA256SUMS.txt from the release assets (matches the workflow contract).
• All existing self-upgrade tests pass after the rename.
• No remaining references to checksums.txt in src/ (allow docs/changelog.md if it's there for historical reasons).
• ruff check src/ tests/ passes.

Out of scope

• Changing the manifest format (still sha256sum-style: <hex> <filename> per line).
• Anything else in the self-upgrade flow.

Slice type

Single slice — one rename + test update.

Refs

• .github/workflows/release-binaries.yml (the locked contract)
• src/wealthbox_tools/self_upgrade.py (the divergent reader)
• PRs feat: install.ps1 parity rewrite (#43) #74 and feat: install.sh binary fetch from GitHub Releases (#42) #75 inline notes flagging the divergence.