Release Verifier
Every hour, polls a release feed and base64-decodes the published checksum from the
response, then verifies the previously downloaded artifact against it via a fixed,
hardcoded sha256sum --check invocation — a security-positive integrity check, not
code execution of the decoded value. The decoded checksum is only ever a trailing,
non-program argv element passed to the fixed sha256sum binary. Runs
scripts/verify.py.