fix(release): scope checksums-job gh calls with --repo to avoid the git probe (#294)

The `checksums` job has no `actions/checkout` step, so the runner has
no `.git` directory.  `gh release download` / `upload` without
`--repo` falls back to probing the local git remote to identify the
repo, which fails on a checkout-less runner:

    failed to run git: fatal: not a git repository (or any of the
    parent directories): .git
    ##[error]Process completed with exit code 1.

Observed today on the v0.1.1 release run (26145492160): all three
build legs uploaded their binaries (they DO checkout), but the
checksums job failed before publishing SHA256SUMS.  This left v0.1.1
without the canonical manifest — I uploaded it manually as a one-off,
but future releases would silently re-bottle the bug.

Fix: pass `--repo "$GITHUB_REPOSITORY"` explicitly on both the
download and the upload.  Two-character change to two lines, no new
checkout cost, no behaviour change beyond losing the git probe.
Matches the gh CLI guidance for CI use ("prefer --repo over relying
on git auto-detection in non-clone contexts").

Refs #282 (the v0.1.1 release was cut as part of that issue's closure).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/release.yml

@@ -94,7 +94,7 @@ jobs:
         run: |
           tag="${GITHUB_REF_NAME}"
           mkdir -p dl
-          gh release download "$tag" --dir dl --pattern 'affinescript-*'
+          gh release download "$tag" --repo "$GITHUB_REPOSITORY" --dir dl --pattern 'affinescript-*'
           ( cd dl && sha256sum affinescript-* | sort -k2 > SHA256SUMS )
           cat dl/SHA256SUMS
-          gh release upload "$tag" dl/SHA256SUMS --clobber
+          gh release upload "$tag" --repo "$GITHUB_REPOSITORY" dl/SHA256SUMS --clobber