Make a version bump possible without editing the workflow first

The digest was a literal in the workflow while the version was an input,
so a dispatch for anything but 1.9.3 built the archive and then failed
its own gate. The digest of a version nobody has reviewed cannot be
known before it is built, which made the inputs unusable for the one job
they exist for.

An empty expected_sha256 now reports the digest of what was built and
refuses to publish; a digest handed in is checked the way the literal
was. The input shapes are also checked before the checkout that uses
them rather than after it.

tests/test_packaging.py

@@ -85,6 +85,20 @@ class WhisperVulkanPackaging(unittest.TestCase):
             self.assertIn(mode, script)
         self.assertTrue((PACKAGING / "Dockerfile.runtime-noicd").is_file())
 
+    def test_an_unreviewed_version_is_reported_and_never_published(self):
+        """The digest of a version nobody has reviewed cannot be known before
+        it is built, so the gate cannot be the only way through."""
+        workflow = WORKFLOW.read_text(encoding="utf-8")
+        self.assertIn("expected_sha256", workflow)
+        self.assertIn(
+            "refusing to publish an archive whose digest has not been reviewed",
+            workflow)
+
+    def test_the_shape_of_the_inputs_is_checked_before_they_are_used(self):
+        workflow = WORKFLOW.read_text(encoding="utf-8")
+        self.assertLess(workflow.index("- name: Validate source coordinates"),
+                        workflow.index("- name: Check out pinned whisper.cpp"))
+
     def test_the_validator_checks_tar_links_before_extraction(self):
         validator = (PACKAGING / "validate-package.sh").read_text(
             encoding="utf-8")