stage-card: write the card's sidecar under the name the placer checks
The daemon placer verifies <card>.sha256 beside a staged card; scripts/stage-card.sh wrote only <card>.sha256.postsign, so SUBC had to ask for the sidecar before placing the 0.64 RC card. The script now writes <card>.sha256 (checked with shasum -c) and keeps the .postsign copy for anything that reads that name. Script syntax and scripts/lib/test_workflow_gates.py (65 tests) pass.
Summary by cubic
Fixes scripts/stage-card.sh so the sidecar is written as <card>.sha256, the name the daemon placer verifies, instead of only <card>.sha256.postsign. Adds a benchmark descriptor for this branch at benchmarks/aft-search/slice-descriptors/land-stage-card-sidecar.json.
Staged cards no longer need the sidecar copied by hand before placement; the .postsign copy is still written for release.sh and dev-rebuild.sh.