fix: check SHA-256 hash of release artifact

[guidanoli]

It's good practice to check the hash of a downloaded file, to avoid supply-chain attacks.
Besides this change, this PR also:

• Forces wget to write the file to add-generated-files.diff by passing the -O option. Without such option, wget may avoid writing over add-generated-files.diff and instead write to add-generated-files.diff.SUFFIX where SUFFIX is some suffix added by wget to avoid collision with an already-existing file.

• Removes the add-generated-files.diff file after applying it. This ensures the Git submodule at machine/emulator stays clean after the repository is setup.