docs(CLAUDE.md): reflect release-checksums variant split

Updates Layout and Lockstep sections to point at the new
release-checksums/{core,consumer}.mts paths and explain the archetype
gating (consumer here ships core+consumer, btm will ship core+producer
once it adopts the new layout).

Author: jdalton

CLAUDE.md

@@ -154,8 +154,8 @@ checksums, stage per-platform packages, and republish them under the
 
 - `packages/iocraft/` — umbrella with `optionalDependencies` + platform loader
 - `packages/iocraft-{darwin,linux,win32}-{arm64,x64}` (+ linux musl variants) — 8 per-platform shims
-- `packages/build-infra/lib/release-checksums.mts` — copy of socket-btm's canonical helper for SHA-256 verification (sync manually from btm until lifted to `@socketsecurity/lib`)
-- `packages/build-infra/release-assets.json` — embedded source-of-truth tag + checksums
+- `packages/build-infra/lib/release-checksums/{core,consumer}.mts` — fleet-canonical helpers for SHA-256 verification + sibling-release fetch. socket-addon ships **core + consumer** (consumer archetype). The third sibling, `producer.mts`, exists in the template but isn't included here — it's for repos that *generate* releases (socket-btm).
+- `packages/build-infra/release-assets.json` — embedded source-of-truth tag + checksums (validated against `release-assets.schema.json`)
 - `scripts/publish.mts` — download → verify → stage → `pnpm publish`
 
 ### Publish flow
@@ -188,6 +188,8 @@ pnpm run publish:ci       # full publish (CI only)
 pnpm run clean            # remove caches
 ```
 
-### Lockstep with socket-btm
+### Fleet-canonical lockstep
 
-`packages/build-infra/lib/release-checksums.mts` is a **manual sync** from `socket-btm/packages/build-infra/lib/release-checksums.mts`. Until that file lifts to `@socketsecurity/lib`, drift is a finding — diff against btm's copy when bumping checksums.
+`packages/build-infra/lib/release-checksums/{core,consumer}.mts` and `packages/build-infra/release-assets.schema.json` are **fleet-canonical** files in `OPTIONAL_IDENTICAL_FILES`. They must be byte-identical to `socket-repo-template/template/`'s copies. `node scripts/sync-scaffolding.mts --target . --fix` rewrites drift; `--fix` never materializes new files (they're opt-in by archetype).
+
+socket-btm currently ships an older single-file JSDoc-typed `release-checksums.mts`. It will be cascaded to the new layout in a follow-up; until then, expect `optional_drift` on btm's side, not ours.