pkg.sh: Use md5 for the dput hash option

Tonight's CI upgraded dput from 1.2.4 to 1.2.6 on Kali Linux and
subsequently failed:

  xzcat /tmp/20261027-010000-rollout-failed.log.xz | grep -ai -C 1 checksum
  Trying to upload package to janware-debian
  Checksum doesn't match for dist/src/jw-pkg_1.0.0-281.dsc
  make[1]: *** [make/pkg-dist.mk:288: pkg-release-reinstall] Error 1

The dput config generated for debian uploads sets hash = sha, while the
Files: section of a .changes file only carries MD5 checksums. dput verifies
each listed file by comparing the configured hash of the file against
that MD5 column, so a sha verification can never match and the upload is
rejected at the first file, the .dsc.

Set the option to md5, the only hash the .changes Files: section carries
and dput's built-in default.

Not sure, yet, if this is a fix or a workaround of a dput bug.

Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v1.4.0
Signed-off-by: Jan Lindemann <jan@janware.com>

scripts/pkg.sh

@@ -631,7 +631,9 @@ upload_pkg()
 		# login =
 		incoming = /var/lib/packager-server/packages/jw-foss/$distro_subdir/incoming/
 		method = rsync
-		hash = sha
+		# the Files: section of the .changes only carries MD5
+		# checksums, so dput's hash option must stay at md5
+		hash = md5
 		allow_unsigned_uploads = yes
 		distributions = debian-8
 		allowed_distributions = `get_os`