Closes #687

Part of kcenon/common_system#674.

What

Adds an independent SHA512 verification step to .github/workflows/on-release-sync-registry.yml. The new verify-archive job re-downloads the GitHub release archive from https://github.com/kcenon/monitoring_system/archive/refs/tags/<tag>.tar.gz, recomputes its SHA512, and runs before the existing sync job that calls the reusable workflow at kcenon/common_system/.github/workflows/sync-vcpkg-registry.yml@main.

Why

Detected via microsoft/vcpkg#51511 and kcenon/vcpkg-registry#87 - every kcenon port shipped a mismatched SHA512 because release workflows never compared the computed value against the actual archive. Cold-cache vcpkg consumers (new CI runners, fresh users) hit 100% install failure when the SHA in vcpkg-registry/ports/kcenon-monitoring-system/portfile.cmake does not match the bytes the consumer actually fetches.

The reusable sync workflow at kcenon/common_system was already hardened in kcenon/common_system PR #676, so monitoring_system inherits that check via the uses: reference. Adding a caller-side verification job in this repo provides defense-in-depth: if the reusable workflow is ever repointed, refactored, or its check is removed, this repo's release pipeline still fails fast on a bad archive.

Where

Audit summary (other workflows considered)

Only on-release-sync-registry.yml participates in writing SHA512 to portfiles, so a single inline verification job in that workflow is appropriate. No composite action extraction is needed.

How

The new verify-archive job runs on ubuntu-latest and:

1. Downloads the release archive to a temp file via curl -fsSL --retry 3 --retry-delay 2 -o <file> <url> (file-based, never piped into sha512sum).
2. Verifies the downloaded file is at least 1024 bytes.
3. Computes sha512sum of the file.
4. Refuses to proceed if the digest equals the well-known empty-input SHA512 (cf83e1357eefb8bdf...), which would indicate a silent fetch failure.
5. The sync job declares needs: verify-archive, so a failed verification short-circuits the registry update before any portfile commit.

The reusable sync workflow at kcenon/common_system performs the same comparison server-side using the SHA it just wrote to the portfile, providing two-layer protection.

Test Plan

How a reviewer can validate the new job fires

1. After merge, cut a release tag (v0.x.y). The Sync Registry on Release workflow triggers automatically.
2. Inspect the run log for the new Verify release archive SHA512 job. On a healthy release, it prints:

   Fetching https://github.com/kcenon/monitoring_system/archive/refs/tags/v0.x.y.tar.gz for SHA512 verification...
   SHA512 of https://github.com/kcenon/monitoring_system/archive/refs/tags/v0.x.y.tar.gz:
     <128-char hex digest>
   Archive size: <N> bytes
   

3. The sync job then runs only if verify-archive succeeded.

Negative-path verification

To confirm the guard fires on a bad archive URL, a maintainer can temporarily replace the TAG env value in the workflow with a non-existent tag on a feature branch and trigger the workflow against a synthetic release - the verify-archive job will fail with ::error::Failed to download release archive, and the sync job will be skipped.

Acceptance Criteria

• Audit identifies all release workflow files in this repo that compute or commit SHA512 (on-release-sync-registry.yml only)
• That workflow includes a "verify SHA against actual archive" gate that runs before the registry sync commits the portfile
• File-based hashing is used (no curl | sha512sum) so 404s cannot produce the empty-input sentinel hash
• Audit summary documents why the other 14 workflows do not need changes

References

• Parent EPIC: [EPIC] Harden release SHA512 automation across all 8 kcenon systems common_system#674
• Reference implementation: chore(release): verify SHA512 against actual archive common_system#675 / PR chore(release): verify SHA512 against actual archive (Part of #674) common_system#676
• Cross-port audit: fix(port): kcenon-common-system portfile SHA512 mismatch (silent until cache miss) vcpkg-registry#87
• Original finding: [kcenon-common-system] new port microsoft/vcpkg#51511