Add checksum-verified release installers

docs/roadmap.md

@@ -142,14 +142,16 @@ For deployment-readiness work that cuts across feature areas, see
   - `[x]` Tests cover the full catalog, family filtering, common aliases, and
     unknown-family recovery.
 
-- `[ ]` Publish copy-paste installation entrypoints for release artifacts.
+- `[x]` Publish copy-paste installation entrypoints for release artifacts.
   Acceptance criteria:
-  - `[ ]` Linux, macOS, and Windows installation instructions verify artifact
+  - `[x]` Linux, macOS, and Windows installation instructions verify artifact
     checksums and put the single `geth` executable on `PATH`.
-  - `[ ]` Installation stays separate from explicit `geth daemon install` so
+  - `[x]` Installation stays separate from explicit `geth daemon install` so
     downloading a binary never silently creates trust state or starts a service.
-  - `[ ]` Upgrade and uninstall instructions preserve or explicitly remove the
+  - `[x]` Upgrade and uninstall instructions preserve or explicitly remove the
     selected geth home.
+  - `[x]` Tagged release CI smoke-tests checksum verification and the installed
+    binary through the same Unix and PowerShell entrypoints users run.
 
 ## Long-Term Goal: Distributed Homelab Overlay
 
@@ -425,8 +427,10 @@ control, local CAS, service installation, and written architecture decisions.
     dispatch, and a weekly schedule.
   - `[x]` CodeQL and dependency review workflows are present for GitHub-native
     security scanning.
-  - `[x]` Release workflow builds Linux, macOS, and Windows archives for `v*`
-    tags and manual dispatch.
+  - `[x]` Release workflow builds Linux x86_64, macOS x86_64/arm64, and Windows
+    x86_64 archives for `v*` tags and manual dispatch.
+  - `[x]` Release archives have SHA-256 files, an aggregate checksum manifest,
+    and checksum-verifying installer smoke tests.
   - `[x]` Dependabot is configured for Cargo and GitHub Actions updates.
 
 - `[x]` Bootstrap docs and ADRs.