Add artifact fetch build support

[mosuem]

Summary

• Configures hooks.user_defines.webcrypto.buildMode: fetch as the default build mode in pubspec.yaml.
• Updates hook/build.dart to support fetch (default), build (local CMake compilation), and local (custom local binary) modes.
• Adds SHA256 integrity checks against lib/src/hook_helpers/hashes.dart.
• Adds tool/regenerate_hashes.dart to autogenerate release hash tables.
• Adds .github/workflows/release-artifacts.yml covering Linux, macOS (x64, arm64), Windows, Android (arm64, arm, x64), and iOS (arm64).
• Enables manual workflow_dispatch for workflow testing without publishing releases.
• Pins GitHub Actions to full commit SHA hashes.

After merging, we need to run the artifact generation once to get the hashes.

[HamdaanAliQuatil]

Thanks for putting this together. ICU4X is a useful reference, and I like the checksum verification and the explicit build/local modes.

I think we should choose the distribution model before getting too far into the implementation. #315 includes the CI-build binaries in the pub package, while this PR downloads only the required target binary from GitHub Releases.

The fetch approach has a good size advantage once we add mobile targets and static archives. The packaged approach makes releases and offline builds simpler. I don’t think runtime fetching is necessarily a blocker, but we should agree on how assets and hashes are produced before publishing, what happens when GitHub cannot be reached, and whether release assets are treated as immutable.

There are also a few implementation details to settle, including the current 0.6.1 versus v0.6.1 tag naming and validation of the Android and iOS outputs. I’d merge #324 separately so this PR stays focused on artifact delivery.

@jonasfj, which direction do you think makes more sense for us long-term? It may also be worth comparing the actual total artifact size before choosing.