fix(ci): make SHA-256 checksum step bash-3.2 safe (macOS runner) (#265)

The "Compute SHA-256 checksums" step used `mapfile -t` (a bash 4+ builtin) but
macOS GitHub runners execute `shell: bash` as /bin/bash 3.2, which has no
`mapfile`. The step exited 127 ("mapfile: command not found") on the macOS leg,
so `SHA256SUMS-macOS Apple Silicon.txt` was never produced/uploaded for v0.3.1
and v0.3.2 (the binaries themselves shipped fine; only the macOS checksum file
was missing and had to be regenerated by hand each time).

Replace `mapfile` with a portable `while IFS= read -r … done < <(find … | sort)`
loop (works on bash 3.2). Verified on bash 3.2.57: builds the array correctly,
handles spaces in bundle filenames. Linux/Windows legs are unaffected.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -540,7 +540,13 @@ jobs:
 
           # Gather artifact paths per matrix leg's `bundles` (msi/app/dmg/deb/appimage/updater).
           # `find` is portable across all three runners (Git Bash on Windows).
-          mapfile -t ARTIFACTS < <(find "$BUNDLE_DIR" -type f \
+          # NB: macOS runners use /bin/bash 3.2, which has no `mapfile` (a bash 4+
+          # builtin) — using it 127'd this step and dropped the macOS SHA256SUMS
+          # for v0.3.1 and v0.3.2. A `while read` loop is portable to bash 3.2.
+          ARTIFACTS=()
+          while IFS= read -r artifact; do
+            ARTIFACTS+=("$artifact")
+          done < <(find "$BUNDLE_DIR" -type f \
             \( -name "*.dmg" -o -name "*.app.tar.gz" -o -name "*.app.tar.gz.sig" \
                -o -name "*.msi" -o -name "*.msi.sig" \
                -o -name "*.AppImage" -o -name "*.AppImage.sig" \