Release verification

1. Download the release archive and matching .sha256 file.
2. Verify it before installation: shasum -a 256 -c "$ARCHIVE.sha256".
3. Extract and run agent-exec --version.
4. Smoke test managed execution: agent-exec run -- echo release-smoke.

GitHub Actions builds Linux x86_64 archives for version tags. macOS artifacts are built and packaged on the trusted macOS host for the release tag.