Supporty hh-codegen-verify-signatures on nightly releases

Make travis.sh use /bin/bash instead of /bin/sh

`foo/{file1,file2}.php` is a bashism.

Also add comment explaining why we're doing both that and regen'ing +
diffing