Add SHA-256 checksum verification for binary distributions

[ishulgin]

This PR adds optional SHA-256 checks for binary distributions. Changes scope cover:

1. Schema + docs update - new optional sha256 field on each binaryTarget.
2. Verification via verify_agents.py - after downloading a binary archive, the verifier hashes the file and fails with a mismatch message if it doesn't match the declared sha256.
3. Auto-update via update_versions.py - when bumping a GH-hosted binary, always refreshes each target's sha256 from the release's asset digest field. Non-GH repos are skipped entirely.