Housekeeping: checksums, workflow permissions, README.md

[alganet]

• Add a test to prevent us from writing workflows with no explicit permissions.
• Add explicit permissions to all workflows.
• Move checksums/ to checksum/sources/ in preparation for true artifact checksums and reproducibility.
• README.md updates.

[Copilot]

Pull request overview

This PR implements security and organizational improvements by adding explicit permissions to workflows, reorganizing checksum storage, and updating documentation. The changes enforce workflow security best practices while preparing the project structure for future artifact checksums and reproducibility features.

Key changes:

• Adds a verification job to prevent workflows from being created without explicit permissions
• Moves checksums from checksums/<shell>/ to checksums/sources/<shell>/ directory structure
• Relocates checksum documentation from main README.md to dedicated checksums/README.md

Reviewed changes

Copilot reviewed 6 out of 566 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
checksums/README.md	New dedicated documentation for checksum verification process
README.md	Removes checksum documentation section (moved to checksums/README.md)
.github/workflows/test-verification.yml	Adds permissions and new job to verify all workflows have explicit permissions
.github/workflows/docker-test.yml	Adds explicit permissions declaration
.github/workflows/docker-latest.yml	Adds explicit permissions declaration
.github/workflows/docker-all.yml	Adds explicit permissions declaration