fix: pin SBOM sort collation and report a missing sha256sum by name

[justinjoy]

Two independent one-issue fixes, both found while writing #750's consumer
documentation. Closes #1291 and #1292.

fix(sbom): pin sort collation so the snapshot baseline is reproducible — #1291

sbom/snapshot.txt is a committed artifact, but nothing pinned the collation of
the sort producing it. Under glibc's en_US collation, leading punctuation is
ignored, so the three ./.github/workflows/*.yml entries sort among the
alphabetic names instead of before them. Regenerating on a non-C-locale machine
produced three spurious reordering hunks alongside the real dependency change —
in a gate whose whole purpose is making dependency drift reviewable.

The gate itself was never locale-broken. check-sbom-snapshot.sh re-sorts
both sides in the same process, so its verdict is order-insensitive even fully
unpinned. The defect is confined to generate-sbom.sh, whose output is
committed. The pins on the gate are defence in depth — load-bearing for the new
test, never for detection.

scripts/ci/check-sbom-snapshot-locale.sh follows the shape #886 established
for this same bug class: a pin without a regression test is a pin somebody
deletes later. It is honest about being weaker than #886's, which stubs nm and
runs the real gate — generate-sbom.sh hardcodes its output to sbom/, so
running it here would clobber the baseline. #1293 tracks the
output-directory parameter that would allow the stronger form.

Two details worth flagging for review, both found by mutation testing:

• The guard matches \bsort\b and drops whole-line comments afterwards. An
  ^[^#]* prefix cannot cross the '^#' literal in check-sbom-snapshot.sh's
  own comment-stripping line, and so skipped the very sort it was meant to check.
• It requires LC_ALL=C specifically. An inherited LC_ALL overrides an
  LC_COLLATE prefix, so LC_COLLATE=C is silently ineffective on exactly the
  machines this fixes — verified, and it is a correctness requirement rather than
  a style rule.

Also pins ci-pr.yml's SBOM debug path, which printed an unpinned scan directly
beneath a C-ordered baseline: two windows that disagreed only on an off-locale
runner, and only while someone was reading them to diagnose a failure.

fix(release): report a missing sha256sum by name — #1292

verify-release.sh guarded b3sum, cosign and gh but invoked sha256sum
bare, so a consumer without GNU coreutils hit sha256sum: command not found on
the first verification recipe. make-tarball.sh:16-17 already guards both, so
the verifier was the one place diverging from the repo's own pattern.

This is a diagnostics fix, not a correctness or portability one. The old
behaviour was never a false pass — set -euo pipefail aborted at exit 127 — and
a macOS consumer still cannot run the script afterwards; they get a named
prerequisite error instead of an internal-looking failure.

Testing

--suite sbom goes 1 → 2. The locale guard runs in 0.05s, needs no syft, and
skips cleanly without an en_US locale or jq. Between the three review gates,
twelve mutations were run against the final tree; all are caught, and the two
whole-line-comment cases correctly pass.

The sha256sum guard was verified with a stub PATH: sha256sum is required,
exit 1, before any digest — versus command not found, exit 127, previously.

Found while doing this, filed rather than folded in

• release gates: unpinned sort feeds pinned manifest hashes, so an off-locale runner reports tampering #1294 — two worse instances of the same class, where an unpinned sort
  feeds a hash compared against a pinned value. run-doop-perf-gate.sh:69
  fails with DOOP dataset manifest ... != pinned ..., which accuses the
  dataset; run-downstream-matrix.sh:141,149 feeds committed oracles from a job
  release-tag.yml:279 invokes, so it gates GA. The issue also warns that the
  fix must first confirm the existing pinned constants were computed under C
  collation, or it converts an intermittent failure into a permanent one.
• generate-sbom.sh hardcodes its output directory, so it cannot be tested #1293 — generate-sbom.sh cannot be tested because it hardcodes its output.
• verify-release.sh and make-tarball.sh have no automated coverage #1295 — verify-release.sh and make-tarball.sh have no coverage at all,
  and the former is the only script third parties are told to run.