Add CMD passthrough docs and release checksums

Document the supervisor lifecycle model for standalone binary users.
Add SHA256 checksum generation for binary releases.

Author: ghostwriternr

.github/workflows/release.yml

@@ -264,5 +264,6 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           VERSION=${{ needs.unit-tests.outputs.version }}
+          sha256sum sandbox-linux-x64 > sandbox-linux-x64.sha256
           # Tag format matches changesets: @cloudflare/sandbox@VERSION
-          gh release upload "@cloudflare/sandbox@${VERSION}" ./sandbox-linux-x64 --clobber
+          gh release upload "@cloudflare/sandbox@${VERSION}" ./sandbox-linux-x64 ./sandbox-linux-x64.sha256 --clobber

docs/STANDALONE_BINARY.md

@@ -17,6 +17,15 @@ ENTRYPOINT ["/sandbox"]
 CMD ["/your-startup-script.sh"]  # Optional: runs after server starts
 ```
 
+## How CMD Passthrough Works
+
+The `/sandbox` binary acts as a supervisor:
+
+1. Starts HTTP API server on port 3000
+2. Spawns your CMD as a child process
+3. Forwards SIGTERM/SIGINT to the child
+4. If CMD exits 0, server keeps running; non-zero exits terminate the container
+
 ## Required Dependencies
 
 | Dependency | Required For                                    | Install Command        |