feat(updater): verifikasi SHA-256 sebelum mengganti AppImage; CI menerbitkan .sha256 + .zsync

- do_update: unduh → verifikasi checksum rilis → baru ganti berkas (mismatch = dibatalkan)
- workflow: hasilkan GAMEMAX-LCD-x86_64.AppImage.sha256 dan .zsync (zsyncmake), lampirkan ketiganya
- README: bagian Updates menjelaskan checksum + zsync (delta update opsional)
- versi 1.2.3

.github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
-            libgl1 libegl1 libxkbcommon0 libdbus-1-3 libfuse2 fuse
+            libgl1 libegl1 libxkbcommon0 libdbus-1-3 libfuse2 fuse zsync
 
       - name: Set up uv
         uses: astral-sh/setup-uv@v5
@@ -38,6 +38,15 @@ jobs:
         run: |
           ./dist/GAMEMAX-LCD-x86_64.AppImage --selftest
 
+      - name: Checksum and zsync metadata
+        run: |
+          cd dist
+          sha256sum GAMEMAX-LCD-x86_64.AppImage > GAMEMAX-LCD-x86_64.AppImage.sha256
+          zsyncmake -u "https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/GAMEMAX-LCD-x86_64.AppImage" \
+            -o GAMEMAX-LCD-x86_64.AppImage.zsync GAMEMAX-LCD-x86_64.AppImage
+          cat GAMEMAX-LCD-x86_64.AppImage.sha256
+          ls -l
+
       - name: Publish release
         uses: softprops/action-gh-release@v2
         with:
@@ -58,5 +67,12 @@ jobs:
             Device access still needs the udev rule once:
             `sudo cp packaging/70-gamemax.rules /etc/udev/rules.d/ && sudo udevadm control --reload`
 
+            **Integrity:** verify the download with the published SHA-256, or use
+            `appimageupdatetool`/AppImageUpdate with the `.zsync` asset for delta updates.
+            The built-in updater (v1.2.3+) also verifies that checksum before replacing itself.
+
             Independent project, not affiliated with the vendor — see DISCLAIMER.md.
-          files: dist/GAMEMAX-LCD-x86_64.AppImage
+          files: |
+            dist/GAMEMAX-LCD-x86_64.AppImage
+            dist/GAMEMAX-LCD-x86_64.AppImage.sha256
+            dist/GAMEMAX-LCD-x86_64.AppImage.zsync