fix: make LoongArch preview checksum portable

Generate SHA256SUMS from inside the timestamped artifact directory so it records only the DEB filename and remains verifiable after copying the preview output elsewhere.

build/loongarch-cross/preview-deb.sh

@@ -300,7 +300,10 @@ assert_loongarch_elf \
 assert_loongarch_elf \
   "${verify_root}/opt/${application_directory}/resources/app/${koffi_binding#${app_root}/}"
 
-sha256sum "${artifact}" > "${artifact_root}/SHA256SUMS"
+(
+  cd "${artifact_root}"
+  sha256sum "${artifact_name}" > SHA256SUMS
+)
 cat > "${artifact_root}/preview-manifest.json" <<EOF
 {
   "formatVersion": 1,

tests/loongarch-cross.test.ts

@@ -97,6 +97,9 @@ describe('LoongArch preview package contract', () => {
     expect(previewScript).not.toContain(
       'node_pty_version="1.1.0"'
     )
+    expect(previewScript).toContain(
+      'sha256sum "${artifact_name}" > SHA256SUMS'
+    )
     expect(previewScript).toContain(
       'assert_loongarch_elf "${koffi_binding}"'
     )