Closes #691

Part of #674.

What

Adds an independent SHA512 verification step to .github/workflows/on-release-sync-registry.yml that re-downloads the release archive from GitHub and confirms the digest is computable before delegating to the reusable kcenon/common_system/.github/workflows/sync-vcpkg-registry.yml@main. The new verify-archive job is a hard dependency of sync (needs: verify-archive), so a fetch failure or empty digest short-circuits the run before any portfile commit reaches kcenon/vcpkg-registry.

Why

Detected via microsoft/vcpkg#51511 and kcenon/vcpkg-registry#87 — every kcenon port shipped a mismatched SHA512 because release automation never compared the computed value against the actual archive. Cold-cache vcpkg consumers (new CI runners, fresh users) hit 100% install failure when the SHA in vcpkg-registry/ports/kcenon-thread-system/portfile.cmake does not match the bytes at https://github.com/kcenon/thread_system/archive/refs/tags/v<version>.tar.gz. This PR closes the detection gap for thread_system, mirroring the pattern merged into common_system via kcenon/common_system#676.

Where

Audit summary (other workflows considered)

grep -l -E "sha512|SHA512|sha512sum" over .github/workflows/* returned zero matches in thread_system; the only release-coupled workflow is on-release-sync-registry.yml. Hardening that single workflow inline is sufficient — no composite action extraction required.

How

The new verify-archive job runs on the same release.published trigger as the existing sync call.

1. Constructs https://github.com/kcenon/thread_system/archive/refs/tags/${TAG}.tar.gz from github.event.release.tag_name.
2. Downloads to a mktemp file with curl -fsSL --retry 3 -o "${TMP}". File-based, not piped. Piping into sha512sum masks fetch failures because SHA512 of empty input is the fixed constant cf83e1357eefb8bdf... — a 404 would still produce a valid-looking digest.
3. Runs sha512sum "${TMP}" | awk '{print $1}', removes the temp file, and asserts the digest is non-empty.
4. Exposes the digest as job output verify-archive.sha512 for future cross-job consumers.
5. The sync job adds needs: verify-archive, so it cannot run if pre-flight verification fails.

Runtime: ~1-2s on a typical thread_system archive.

Test Plan

How a reviewer can validate the new job fires

1. Cut a release tag (v0.x.y) — the workflow triggers on release.published.
2. Inspect the run log for the new job Verify release archive SHA512. On a healthy release, the step prints:

   Re-fetching https://github.com/kcenon/thread_system/archive/refs/tags/v0.x.y.tar.gz for independent verification...
   Archive SHA512 verified for v0.x.y:
     <128-char hex digest>
   

Failure-mode coverage

• Bad URL path (nonexistent tag): curl -fsSL fails with non-zero exit code. The if ! branch fires exit 1 with annotation Failed to download release archive: <URL>. The download-to-file pattern is required: piping into sha512sum would otherwise mask the curl failure with the empty-input hash.
• Empty digest path (defensive): even if sha512sum somehow produces an empty string, the explicit [ -z "${ACTUAL_SHA}" ] check fails with Computed SHA512 is empty.
• Sync gating: sync declares needs: verify-archive, so any failure in pre-flight prevents the reusable workflow from running and prevents any commit landing in kcenon/vcpkg-registry.

YAML structure validated by re-reading the file post-edit (job keys, step names, needs reference).

Breaking Changes

None. The new job is additive and runs on the same release.published trigger. On a healthy release it adds ~1-2s and one log line. On a fetch failure (the failure mode this PR is designed to detect) it short-circuits the run before any vcpkg-registry commit, which is the desired behavior.

Reference

This PR mirrors the validated pattern from kcenon/common_system#676, which merged with full CI green and hardens the upstream reusable workflow consumed by this repo. The two layers are complementary: this PR adds an independent pre-flight check that runs even if the upstream workflow ref changes, and the upstream PR hardens the actual SHA-write path.