pinkerton,util/release: Calculate and check image tarsums

Closes #612
This should have a comment to the effect of:

> TODO: This is insecure, as we really should not be decoding or unpacking an untrusted blob before we check the checksum. Unfortunately, this is currently unavoidable due to the broken design of the tarsum system.