fix: cover every tracked release input

scripts/lib/release-input-evidence.ts

@@ -0,0 +1,19 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+
+import { supplyChainDigest } from "./supply-chain.ts";
+
+export async function digestReleaseInputFiles(
+  files: readonly string[],
+  readBytes: (file: string) => Promise<Buffer> = readFile,
+): Promise<string> {
+  const rows = await Promise.all(
+    [...files].sort().map(async (file) => ({
+      path: file,
+      sha256: createHash("sha256")
+        .update(await readBytes(file))
+        .digest("hex"),
+    })),
+  );
+  return supplyChainDigest(rows);
+}