feat: extend HASH coverage of OSes

[philclifford]

The following OS definitions do not currently obtain an authoritative hash to permit verification of downloaded images. It would be good to find and implement authoritative hashes for these if possible (and to encourage the upstream projects to make them available if they do not currently provide them).
Supported OSes without a HASH at present:

• archcraft
• blendos
• crunchbang++
• gnomeos
• holoiso
• kolibrios
• maboxlinux
• reactos

[flexiondotorg]

Progress Update: Hash Verification

We've researched the distros listed in this issue and added hash verification where possible.

✅ Now Verified

Distro	Hash Type	Notes
Archcraft	SHA256	Fetches from SourceForge .sha256sum file
blendOS	SHA256	Already implemented (GitLab CI artifact)
KolibriOS	SHA256	Fetches from sha256sums.txt on build server
Mabox Linux	MD5	Fetches from .md5 file in repository

⏳ Needs Upstream Work

Distro	Issue
CrunchBang++	MD5 hashes exist but are embedded in GitHub release notes markdown - not machine-parseable. Would need upstream to provide separate checksum files.

❌ Still No Checksums Published

Distro	Recommendation
GNOME OS	No checksums found on os.gnome.org - consider opening upstream issue
ReactOS	No checksums on SourceForge - consider opening upstream issue

---

4 of 7 distros now have hash verification. The remaining 3 require upstream projects to publish checksums in a usable format.