Fix release package checksum path

[nicodes]

Fixes the deployment blocker found while delivering aviorstudio/fieldsofrevik#145.

Corrections

Originating issue: https://github.com/aviorstudio/fieldsofrevik/issues/145.

• The prior wording incorrectly grouped the post-merge release run with pre-merge gates. Exact-head CI was required before merge; a new release run was required after merge and before deployment completion.
• The prior local unit count said 9/9 because it reported the pre-rebase run. The exact-head/post-rebase suite includes web_fetch_bridge_module_test.gd and passed 10/10 reachable sentinels.

Failure control

Release run https://github.com/aviorstudio/gd-network/actions/runs/34741705851 passed the exact release test job, then failed in the publish job because sha256sum read the checksum manifest from dist/ while resolving its listed ZIP filename from the repository root. GitHub Release and GDAM publish did not run.

Change

Run strict checksum verification through scripts/verify_package_checksum.sh from both the release workflow and tests/package_test.sh. CI reaches the same assertion that gates publication.

Self-verification

• Restored helper and package lifecycle: PASS locally with Godot 4.7.2.
• Exact-head CI 34742069189: PASS at 652492faa65a3dbf7bcfad6275507d931a3867fb.
• Exact-head artifact 10313230687: strict ZIP checksum PASS (c0d1acaabd09e146837175c4badd486e91b88481c7bd0b32020e37b4f9882866); closed 21-file manifest and installed-tree digest 0a5a5c7c0573552d29e591294c061a0d3e06479403f85438b383411b4f24acf6.
• Unit suite: PASS, 10/10 reachable sentinels on the exact head.
• Package lifecycle: PASS for install/enable/restart/smoke/disable/restart.
• Post-merge Release 34742259330: PASS; v0.0.3 published.

[nicodes]

Exact-head acceptance evidence

Originating issue: https://github.com/aviorstudio/fieldsofrevik/issues/145

• Source head 652492faa65a3dbf7bcfad6275507d931a3867fb; merge state CLEAN.
• CI PASS: https://github.com/aviorstudio/gd-network/actions/runs/34742069189.
• The package test reached the same scripts/verify_package_checksum.sh helper used by Release / publish and passed.
• Artifact ID 10313230687, digest sha256:e902e258c4ec2bfbb29a02f6f468a57b9deb3d04a026b6663ce4cdea7200bec2; downloaded ZIP checksum PASS c0d1acaabd09e146837175c4badd486e91b88481c7bd0b32020e37b4f9882866; installed-tree digest 0a5a5c7c0573552d29e591294c061a0d3e06479403f85438b383411b4f24acf6.
• Closed package manifest: 21 files; package install/enable/restart/smoke/disable/restart PASS.
• Failure control remains release run https://github.com/aviorstudio/gd-network/actions/runs/34741705851, which failed before publication under the old path handling.

All pre-merge gates for this correction pass. Release and GDAM verification remain post-merge gates.