Verify hashes in the release manifests

[nagilson]

dotnetup has failed in CI several times due to an invalid hash in the release, so let's check the hashes to help the release team see which releases need validation/changes.

Throw away script and CI change.

[nagilson]

/azp run

[azure-pipelines]

Azure Pipelines failed to run 1 pipeline(s).

[Copilot]

Pull request overview

Adds a PowerShell-based verification step intended to catch invalid SHA-512 hashes in .NET release manifests earlier (before they break dotnetup CI), and wires this verification into the dnup PR pipeline.

Changes:

• Added Verify-ReleaseHashes.ps1 to download release assets referenced by releases.json and verify their SHA-512 hashes.
• Updated .vsts-dnup-pr.yml to run hash verification for channels 7.0–10.0 and to add an executables build stage.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
src/Installer/releases/Verify-ReleaseHashes.ps1	New script to fetch a channel’s releases.json, download .zip/.tar.gz assets, compute SHA-512, and report mismatches.
.vsts-dnup-pr.yml	Adds stages/jobs to build dotnetup executables and to run/publish hash verification results for multiple channels.

Comments suppressed due to low confidence (1)

.vsts-dnup-pr.yml:11

• The PR branch include list adds a specific topic branch name (nagilson-dnup-executables). If this branch is not intended to be a long-lived target branch, keeping it here will cause unexpected PR validation behavior and future maintenance churn. Consider removing it before merging unless it’s meant to be a permanent branch pattern.

    - dnup
    - release/dnup
    - release/dotnetup