fix(release): resolve Go checksums from metadata

[ssfun]

Summary

• resolve Linux Go archive checksums from the official Go download metadata API
• validate the resolved digest before passing it into the pinned manylinux container
• keep archive verification before extraction without maintaining per-version checksums

Root cause

The release workflow treated https://go.dev/dl/<archive>.sha256 as a checksum asset. That endpoint returns an HTTP 200 HTML redirect page, so both Linux glibc plugin builds failed in sha256sum during run 29936326151.

Validation

• resolved valid Go 1.26.0 amd64 and arm64 SHA256 values from official metadata
• 19 Management customization/security tests passed
• 2 reproducible archive tests passed
• JSON, syntax, action pin and whitespace validation passed
• local Docker smoke test unavailable because the OrbStack socket is not accessible; required PR CI remains the remote gate