ci: publish source archive checksums

[zcxGGmu]

Summary

• publish SHA-256 values for GitHub-generated zip and tar.gz source archives when a release is published
• stream archive hashing so large repositories do not require buffering an entire archive in memory
• preserve existing release notes and idempotently replace only the marked checksum section
• run focused Node tests on pull requests before enabling the release update job

Fixes #4743

Testing

• node --test .github/scripts/release-source-checksums.test.mjs
• node --check .github/scripts/release-source-checksums.mjs
• node --check .github/scripts/release-source-checksums.test.mjs
• npx --yes prettier@3.0.3 --check .github/scripts/release-source-checksums.mjs .github/scripts/release-source-checksums.test.mjs .github/workflows/publish-source-checksums.yaml
• actionlint .github/workflows/publish-source-checksums.yaml (v1.7.12)
• streamed and hashed both real v1.15.0 source archives: zip (9,866,074 bytes, 6722e1f0...0ca10) and tar.gz (8,839,053 bytes, 519fc8ad...57f24)
• repeated the complete zip download and confirmed identical size and SHA-256

Caveats

• The live release PATCH was not exercised locally because that would modify an existing upstream release. The complete download/read/update request sequence is covered with a fetch mock.