downloads: flat repo root — deb + Windows msi/zip visible directly

Drop the debs/ subdir and put every download at the repo root so both the
Debian .deb and the Windows .msi/.zip show up directly in the file list.
Stop gitignoring the binaries; add a root SHA256SUMS covering all of them.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -10,9 +10,10 @@ with each package.
 
 © 2025–2026 bjorne, SA7AUX — GNU General Public License v2 or later.
 
-## Windows
+All downloads sit in the root of this repository — grab the file you need
+directly, or from the [releases](../../releases) page.
 
-Download from the [latest release](../../releases):
+## Windows
 
 | File | For |
 |---|---|
@@ -33,7 +34,7 @@ msiexec /i darthvader-<version>-win64.msi /qn
 The packages are **not code-signed**, so SmartScreen warns on first run
 (*More info* → *Run anyway*), and a few engines flag them on reputation alone
 — Microsoft Defender on a real machine does not. Verify the SHA-256 against
-`SHA256SUMS` in the release; that is what the checksums are there for.
+`SHA256SUMS`; that is what the checksums are there for.
 
 DV3000 / ThumbDV / DVstick sticks appear as COM ports through the FTDI VCP
 driver and are detected automatically. If audio stutters, lower the port's
@@ -41,8 +42,8 @@ driver and are detected automatically. If audio stutters, lower the port's
 
 ## Debian / Raspberry Pi OS
 
-`.deb` packages in [`debs/`](debs/) — bookworm and trixie, `amd64` and `arm64`
-(Pi Zero 2 W and newer):
+`.deb` packages in the repository root — trixie `amd64` today, bookworm and
+`arm64` (Pi Zero 2 W and newer) to follow:
 
 ```sh
 sudo apt install ./darthvader_<version>_<arch>.deb
@@ -50,7 +51,7 @@ sudo apt install ./darthvader_<version>_<arch>.deb
 
 ## Verifying downloads
 
-Each release lists SHA-256 sums in `SHA256SUMS`:
+`SHA256SUMS` in the root lists the sums for every file here:
 
 ```sh
 sha256sum -c SHA256SUMS