fix(ci): publish large Hangar releases by URL

[robinbraemer]

Summary

• publish Hangar platform files as immutable versioned GitHub release URLs
• retain each platform SHA-256 in the public Hangar version description
• verify Hangar review/visibility, compatibility metadata, page content, external URLs, GitHub asset digests, final download size/content type/hash, and JAR magic

Failure fixed

Safe backfill run 30561394182 authenticated successfully, updated the Hangar page, and reached version creation. Cloudflare rejected the single multipart request with HTTP 413 because the three shaded jars total about 178 MB.

Hangar's documented API exposes one version-creation request and supports an externalUrl for each platform file; it exposes no incremental upload endpoint. This change uses the immutable 0.13.1-style GitHub release URLs instead of mutable latest links. It does not attempt to bypass Hangar's edge limit.

Because external Hangar downloads have no fileInfo.sha256Hash, the workflow stores all three SHA-256 values in the public version description, checks them against GitHub's stored asset digest, then downloads every artifact through Hangar and checks the final bytes itself.

Verification

• all 9 ReleaseHangarPublishTest tests pass
• extracted Hangar script passes bash -n and shellcheck -s bash
• ./gradlew build --no-daemon --console=plain exits 0
• public Hangar page already matches the checked-in content, apart from Hangar's final-newline normalization

After merge, dispatch release.yml with --ref main and input release_tag=0.13.1.