feat(release): add signature, checksum and verification instructions

docs/07_deployment_and_ops.md

@@ -133,6 +133,13 @@ This script builds a release binary, creates a Git tag, and uploads the release
 ```bash
 # WARNING: This script contains a hardcoded secret token. Do not use it as-is for production.
 ```
+- **Release Assets:** It generates a `.tar.gz` archive with the binaries, a `.sha256` checksum file, and a `.sig` GPG detached signature.
+- **Signature:** The release tarball is signed with the GPG key `Svātantrya <svatantrya@bitcoin-after.life>`. The script verifies that `gpg`, `sha256sum`, and `jq` are installed before proceeding.
+- **Verification:** The release body includes instructions for verifying the checksum and signature:
+  ```bash
+  sha256sum -c <release>.tar.gz.sha256
+  gpg --verify <release>.tar.gz.sig <release>.tar.gz
+  ```
 - **Security:** It also builds and uploads the binaries. The binaries should be built and signed on a separate, clean build machine, not on the production server.
 
 ### `download_bal_db.sh` (Database Pull Script)