fix(release): install.sh asset matching + SHA256SUMS + Dockerfile 1.25.12

install.sh:
- find_asset_url now matches by asset NAME (python3 JSON parse), not
  URL path — Gitea attachment URLs are opaque UUIDs that don't contain
  the tarball name. This was the root cause of the v0.12.18 install
  failure (asset existed but install.sh couldn't find it).
- find_asset_in_releases walks recent releases by asset name and
  returns both URL + version for the fallback walk.
- Handles 404 (tag without release) gracefully via fallback walk.

Dockerfile:
- golang:1.25 -> golang:1.25.12 (go.mod requires 1.25.12; the Docker
  image was using patch 0, causing `go mod download` to fail with
  "go.mod requires go >= 1.25.12 (running go 1.25.10)")

coreci.yml:
- All golang:1.25 images -> golang:1.25.12
- Release pipeline: add SHA256SUMS generation (sha256sum tarball)
- Release pipeline: attach SHA256SUMS alongside tarball
- Release pipeline: verify assets are actually attached after
  tea releases create (REQ-097 gate C-21); auto-attach via API if
  tea failed silently

release.sh:
- Add SHA256SUMS generation (sha256sum tarball > SHA256SUMS)

---ci---
project: orca
milestone: v0.12.18
phase: release-fix
status: complete
---/ci---

scripts/install.sh

@@ -111,34 +111,57 @@ TARBALL="orca-${VERSION}-${OS}-${ARCH}.tar.gz"
 
 find_asset_url() {
   # $1 = tag. Prints the browser_download_url for the matching tarball, or empty.
-  # The `|| true` prevents set -e + pipefail from exiting the script when
-  # grep finds no match (exit 1) — an empty result is a valid outcome.
+  # Match by asset NAME (not URL path) — Gitea attachment URLs are opaque
+  # UUIDs that don't contain the tarball name.
   local tag="$1"
-  curl -fsSL "${GITEA_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/releases/tags/${tag}" \
-    | sed -n 's/.*"browser_download_url"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' \
-    | grep "/${TARBALL}\$" \
-    | head -1 || true
+  local json
+  json="$(curl -fsSL "${GITEA_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/releases/tags/${tag}" 2>/dev/null)" || return 1
+  if command -v python3 >/dev/null 2>&1; then
+    echo "$json" | python3 -c "
+import json,sys
+r=json.load(sys.stdin)
+for a in r.get('assets',[]):
+    if a.get('name')=='$TARBALL':
+        print(a.get('browser_download_url',''))
+        break
+" 2>/dev/null || true
+  else
+    echo "$json" | sed -n 's/.*"name"[[:space:]]*:[[:space:]]*"$TARBALL".*"browser_download_url"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1 || true
+  fi
+}
+
+find_asset_in_releases() {
+  # Walk recent releases, find the newest with a matching asset name.
+  # Outputs two lines: URL and VERSION (caller captures both).
+  local json
+  json="$(curl -fsSL "${GITEA_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/releases?limit=50" 2>/dev/null)" || return 1
+  if command -v python3 >/dev/null 2>&1; then
+    echo "$json" | python3 -c "
+import json,sys,re
+rels=json.load(sys.stdin)
+for r in rels:
+    tag=r.get('tag_name','')
+    for a in r.get('assets',[]):
+        name=a.get('name','')
+        m=re.match(r'orca-(v[0-9.]+)-' + '${OS}' + '-' + '${ARCH}' + r'\.tar\.gz$', name)
+        if m:
+            print(a.get('browser_download_url',''))
+            print(m.group(1))
+            sys.exit(0)
+"
+  fi
 }
 
 info "locating asset ${TARBALL} in release ${VERSION}..."
-ASSET_URL="$(find_asset_url "$VERSION")"
+ASSET_URL="$(find_asset_url "$VERSION" 2>/dev/null)" || true
 
 if [ -z "$ASSET_URL" ]; then
   info "WARNING: release ${VERSION} has no ${TARBALL} asset. Walking back through recent releases..."
-  # The /releases list endpoint returns assets inline (browser_download_url
-  # appears within each release's assets array). Extract all download URLs
-  # from the list response and find the first (newest) one matching our
-  # OS+arch tarball pattern (any version). This avoids per-release API calls.
-  ASSET_URL="$(curl -fsSL "${GITEA_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/releases?limit=50" \
-    | grep -oE '"browser_download_url"[[:space:]]*:[[:space:]]*"[^"]*"' \
-    | sed -n 's/.*"browser_download_url"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' \
-    | grep -E "/orca-[^/]*-${OS}-${ARCH}\.tar\.gz$" \
-    | head -1 || true)"
+  FALLBACK_OUT="$(find_asset_in_releases || true)"
+  ASSET_URL="$(echo "$FALLBACK_OUT" | head -1)"
   if [ -n "$ASSET_URL" ]; then
-    # Extract the version from the URL (e.g. .../download/v0.4.5/orca-...)
-    FALLBACK_VERSION="$(echo "$ASSET_URL" | sed -n 's|.*/download/\([^/]*\)/.*|\1|p')"
-    info "WARNING: latest release ${VERSION} has no binary asset; falling back to ${FALLBACK_VERSION} which has orca-${FALLBACK_VERSION}-${OS}-${ARCH}.tar.gz."
-    VERSION="$FALLBACK_VERSION"
+    VERSION="$(echo "$FALLBACK_OUT" | tail -1)"
+    info "WARNING: falling back to ${VERSION} which has orca-${VERSION}-${OS}-${ARCH}.tar.gz."
   else
     err "could not find any release with a ${OS}-${ARCH} tarball in the last 50 releases. Check that a release exists with a linux-${ARCH} binary."
   fi

scripts/release.sh

@@ -101,6 +101,9 @@ info "built: bin/orca (linux-amd64)"
 
 TARBALL="orca-${VERSION}-linux-amd64.tar.gz"
 tar -czf "$TARBALL" -C bin orca
+sha256sum "$TARBALL" > SHA256SUMS
+info "checksum: SHA256SUMS"
+cat SHA256SUMS
 info "packaged: $TARBALL ($(du -h "$TARBALL" | cut -f1))"
 
 # --- release notes from ---ci--- blocks ----------------------------------