Drop MD5 checksums in favour of SHA-256

[hugovk]

Re: python/pythondotorg#1227

Releases since 13th January 2026 only show SHA-256 checksums on their downloads pages:

• https://www.python.org/downloads/release/python-31312/
• https://www.python.org/downloads/release/python-3143/
• https://www.python.org/downloads/release/python-3150a4/
• https://www.python.org/downloads/release/python-3150a5/
• https://www.python.org/downloads/release/python-3150a6/

They also have MD5 checksums stored in the python.org CMS.

Older releases only have MD5 checksums and show those.

At some point in the near future we can stop calculating MD5 checksums during the release process and uploading them to the CMS.

[sethmlarson]

LGTM, I assume we don't want to disturb old pages by "back-filling" SHA-256 values to those releases.

[hugovk]

I don't have a strong opinion on backfilling.

People are more likely to verify new releases than old, so there's less benefit for backfilling.

And not backfilling is definitely easier :)