fix: harden tap bump against layout changes and bad downloads (#294)

This workflow rewrote each checksum by line position:

    gsed -i "/ARTIFACT\"/!b;n;c\      sha256 \"${sha}\""

It matched the url line, advanced one line, and replaced whatever it
landed on. Correct only while sha256 sits directly beneath url inside an
on_macos or on_linux block, which is how Formula/all-smi.rb is written
today.

lablup/mlxcel and lablup/bssh carried the same construct, all three copied
from a common source. In mlxcel it went wrong: the formula moved its url to
the top level with a `version` stanza in between, so the next bump
overwrote `version` with the new checksum and left the previous release's
sha256 below it. The formula ended up with no version and two sha256 lines,
the second of which wins, so `brew install` failed on checksum. Nothing
validated the result and it sat broken in the tap for three days
(lablup/homebrew-tap 9969ec4).

all-smi is not broken today, but it is one formula edit away from the same
outcome. This is the last of the three copies.

Stanzas are now located by name. `set_artifact` finds the url stanza whose
value contains a given artifact, rewrites it, then rewrites the first
sha256 stanza below it, preserving indentation. Anything in between is
skipped rather than clobbered. Guards abort the run when the formula does
not hold exactly one matching url, or when no sha256 follows it, instead of
editing the wrong line.

Two other faults, both shared with bssh and fixed the same way:

Downloads used `curl -Ls` with no `-f`, so a missing or renamed asset
produced a zero-byte file and its checksum went to the tap unnoticed. They
now use `-f --retry 3`, reject empty files, and verify each archive is
readable with `unzip -t` or `tar -tzf`.

`git commit` ran unconditionally, so re-running for a version already in
the tap failed on an empty index. It now exits cleanly.

A validation step runs `ruby -c` and `brew style` on the formula, checks the
version stanza, and requires exactly the three checksums downloaded this
run, which catches a substitution that silently no-ops. `ruby -c` alone is
not enough: the corrupted mlxcel formula was valid Ruby.

Verified against the current tap formula. Bumping to a synthetic version
puts all three urls and checksums in the right place, the validation checks
pass, and `brew style` reports no offenses. The workflow YAML parses.

Unrelated observation, left alone here: the download base is still
https://github.com/inureyes/all-smi, which works only through GitHub's
rename redirect to lablup/all-smi. It also lands in the tap formula's url
stanzas. Worth changing deliberately rather than as a side effect of this
fix, since it alters what gets written to the tap.