site(com): Downloads and Documents, built from a release; the nav links; the release's SHA256SUMS covers every file (#126, #157) [skip ci]

The design canvas (v17) gains the Documents artboard -- the Book of Fabric and
the Dictionary of v4 first, then the book, the three volumes and the API
reference, each with its SHA-256, and the SSRN paper -- and Downloads and
Documents in every .com nav; Downloads' reading list becomes a pointer to
Documents. site/com/canvas/ copied from it.

site/com/build.py --release TAG --sums SHA256SUMS builds Downloads and
Documents from the release ([TAG], [RELEASE]/<file>, [SHA:<file>]; a file the
release's SHA256SUMS lacks fails the build). Without a release it builds Home,
Try it and Inquiries exactly as before -- byte for byte -- with no link to the
two pages, so they go live only with alpha.4. install.sh installs them when
built.

scripts/nightly.sh gitea-release: the release's SHA256SUMS now covers every
file it attaches -- the images' sums, then the PDFs and the Root CA's
certificate -- so `sha256sum -c SHA256SUMS` checks all of it and Documents
finds each sum. The Nexus artifacts keep their own.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

scripts/nightly.sh

@@ -195,15 +195,23 @@ gitea-release)
     : "${RELEASE_TOKEN:?RELEASE_TOKEN: a token that may write the repository}"
     api=${GITEA_API:-${GITHUB_SERVER_URL:-https://gitea.starshipos-f18.org}/api/v1/repos/${GITHUB_REPOSITORY:-rajames/LithosAnanke}}
     need "$OUT/StarshipOS.iso" "$OUT/pc-stick.img.xz" "$OUT/raspi5.img.xz" "$OUT/MilkV.img.xz" "$OUT/SHA256SUMS"
-    files=("$OUT/StarshipOS.iso" "$OUT/pc-stick.img.xz" "$OUT/raspi5.img.xz" "$OUT/MilkV.img.xz" "$OUT/SHA256SUMS")
-    for f in "$DOCS"/*.pdf ci/pki/starshipos-root-ca.pem; do [ -f "$f" ] && files+=("$f"); done
+    # The release's SHA256SUMS covers every file it attaches -- the images' sums as the images
+    # stage wrote them, then the documents and the Root CA's certificate -- so that
+    # `sha256sum -c SHA256SUMS` checks all of it, and the .com's Documents page (site/com/build.py,
+    # #157) finds each document's sum. The Nexus artifacts keep their own SHA256SUMS.
+    rel=$(mktemp -d)
+    cp "$OUT/SHA256SUMS" "$rel/SHA256SUMS"
+    extra=("$DOCS"/*.pdf ci/pki/starshipos-root-ca.pem)
+    for f in "${extra[@]}"; do [ -f "$f" ] && (cd "$(dirname "$f")" && sha256sum "$(basename "$f")") >> "$rel/SHA256SUMS"; done
+    files=("$OUT/StarshipOS.iso" "$OUT/pc-stick.img.xz" "$OUT/raspi5.img.xz" "$OUT/MilkV.img.xz" "$rel/SHA256SUMS")
+    for f in "${extra[@]}"; do [ -f "$f" ] && files+=("$f"); done
     gitea() { curl -fsS -H "Authorization: token $RELEASE_TOKEN" "$@"; }
     body=$(python3 -c '
 import json, sys
 notes, sums, version = sys.argv[1], open(sys.argv[2]).read(), sys.argv[3]
 print(json.dumps(notes.strip() + "\n\n## Checksums (SHA-256)\n\n```\n" + sums.strip() + "\n```\n\n"
       "Also in Nexus: `org.starship:kernelImage:" + version + "` and `org.starship:documentation:" + version + "`.\n"))' \
-      "$(git tag -l --format='%(contents)' "$tag")" "$OUT/SHA256SUMS" "$VERSION")
+      "$(git tag -l --format='%(contents)' "$tag")" "$rel/SHA256SUMS" "$VERSION")
     id=$(gitea "$api/releases/tags/$tag" 2>/dev/null | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])' 2>/dev/null || true)
     if [ -z "$id" ]; then
         pre=false; case "$tag" in *-*) pre=true;; esac
@@ -220,6 +228,7 @@ print(json.dumps(notes.strip() + "\n\n## Checksums (SHA-256)\n\n```\n" + sums.st
         case " $have " in *" $n "*) echo "  $n: there"; continue;; esac
         gitea -o /dev/null -X POST -F "attachment=@$f" "$api/releases/$id/assets?name=$n" && echo "  $n: attached"
     done
+    rm -f "$rel/SHA256SUMS" && rmdir "$rel"
     ;;
 publish-docs)
     url=${2:-}; [ -n "$url" ] || usage