Fix release checksum verification path

[okturan]

Cause

The first v1 tag run built dist/macnetstats.sha256, then verified that manifest from the repository root. Because the manifest intentionally contains the asset basename, sha256sum looked for ./macnetstats instead of dist/macnetstats.

Fix

• Verify the checksum from inside the artifact directory.
• Add the full package/checksum/version dry run to the pull-request verifier, so path or packaging regressions fail before another tag is created.

Local verification

• Release candidate assembled in a clean temporary directory.
• SHA-256 verification passed.
• Packaged script reported MacNetStatsTerm 1.0.0.
• Workflow YAML parsed.
• git diff --check passed.

No GitHub Release was created by the failed tag run.