Sums for releases

Upstream has added `checksums.sha256` (which we hope works) but I like this better because it spreads the task of computing sums to the job runners, and provides all the sha algorithm sums in a format that's easy to grep the algorithm and/or file that you want to use from the `SUMS` file. This is a follow up from: #69