release.yml: flight wasm dropped out of the top-level SHA256SUMS.txt at v1.123 (bundle SHA256SUMS still covers it — consistency, not integrity)

[avrabe]

Observed while verifying v1.123/v1.124: SHA256SUMS.txt (the CLI-assets manifest) included falcon-flight-vX.wasm through v1.122 but not in v1.123/v1.124 — most likely job timing (whether the flight-component job's upload lands before the main job's sha256sum ./* listing).

Not an integrity gap: the wasm is covered by the flight bundle's own cosign-signed SHA256SUMS (+ .sig/.pem/.bundle, the v1.77 FV-RELAY-STREAM-014 chain), and both releases verify:

• v1.123: e4622a12… Verified OK
• v1.124: c8db2dfd… Verified OK

But the inconsistency is a verification-procedure trap (our own release checks greped the wrong manifest and produced a vacuous self-compare before catching it). Fix candidates for the release-standard slice (#216/#222 cluster): either order the jobs so the top-level manifest always includes the wasm, or drop the wasm from the top-level manifest deliberately and document the bundle manifest as its sole signed cover in the release notes template + VERIFICATION-CHAIN docs.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HvusAXYbHLyv3uTzfBcMbG