Harden release artifact verification

tests/release_scripts.rs

@@ -244,6 +244,29 @@ fn complete_release_verifier_requires_both_macos_architectures() {
     assert!(verify.contains("dosh-windows-x86_64.zip"));
 }
 
+#[test]
+fn release_verifier_checks_checksums_and_expected_binaries() {
+    let verify = include_str!("../scripts/verify-release-artifacts.sh");
+    assert!(verify.contains("verify_checksum()"));
+    assert!(verify.contains("release checksum mismatch"));
+    for member in [
+        "dosh/bin/dosh",
+        "dosh/bin/dosh-client",
+        "dosh/bin/dosh-server",
+        "dosh/bin/dosh-auth",
+        "dosh/bin/dosh-bench",
+        "dosh/bin/dosh.exe",
+        "dosh/bin/dosh-client.exe",
+        "dosh/bin/dosh-bench.exe",
+    ] {
+        assert!(
+            verify.contains(member),
+            "release verifier must require archive member {member}"
+        );
+    }
+    assert!(verify.contains("artifact missing expected member"));
+}
+
 #[test]
 fn package_release_stamps_git_build_info() {
     let package = include_str!("../scripts/package-release.sh");