No CI verification for release checksums

[miinso]

checksums in extensions.bzl are manually generated and never verified by CI. if a release artifact changes (re-upload, rebuild) the mismatch goes unnoticed until someone's build breaks.

ref #1