distribution: create sha256sum.txt file when creating version releases

[talam]

This PR closes out #479 by:

• creating a sha256sum.txt file containing sha256 checksums for each pre-built binary that we distribute with our releases. we'll have to attach this file to each release manually for now. we may or may not want to commit this file into the repo in the future, but for now this should be a good start.
• updates our README.md file with some instructions on how to verify pre-build binaries using the sha256sum.txt file we provide.

[ploxiln]

hmm looks like dist.sh wasn't updated to use dep

[talam]

added in an additional commit to remove the gpm references in dist.sh and replace with dep. RFR