fix: populate sha256 in resource files and fix Windows PythonConfiguration

- Add sha256 field to Windows PythonConfiguration (PyPy/GraalPy have
  direct download URLs on Windows too)
- Pass sha256 to install_pypy() and install_graalpy() in windows.py
- Fix update_pythons.py: handle empty sha256 from CPython API (older
  versions) by streaming download to compute it; fix condition to
  check 'not sha256' rather than 'not in dict'
- Fix update_virtualenv.py: compute sha256 even when version unchanged
  but sha256 is empty (first-time population)
- Fix update_python_build_standalone.py: resolve file path relative to
  the script itself (not the installed package) so writes go to source
  checkout, not the uv cache
- Populate actual sha256 values by running all three update scripts

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: copilot-cli:claude-sonnet-4.6

bin/update_python_build_standalone.py

@@ -11,6 +11,8 @@
 # ///
 
 import json
+from pathlib import Path
+from typing import Final
 
 import requests
 
@@ -19,7 +21,13 @@ from cibuildwheel.util.python_build_standalone import (
     PythonBuildStandaloneAsset,
     PythonBuildStandaloneReleaseData,
 )
-from cibuildwheel.util.resources import PYTHON_BUILD_STANDALONE_RELEASES
+
+# Resolve path relative to this script so writes go to the source checkout,
+# not the uv-installed copy of the package.
+DIR: Final[Path] = Path(__file__).parent.parent.resolve()
+PYTHON_BUILD_STANDALONE_RELEASES: Final[Path] = (
+    DIR / "cibuildwheel/resources/python-build-standalone-releases.json"
+)
 
 
 def main() -> None:

bin/update_pythons.py

@@ -535,9 +535,11 @@ class AllVersions:
 
         # Fill in sha256 for URL-based configs if not already provided by the
         # update_version_* method (e.g. PyPy, BeeWare iOS, Maven have no sidecar).
+        # Also fills in sha256 when the CPython API doesn't return a sha256_sum
+        # (e.g. for older releases).
         # Widen the type to allow arbitrary key access on the underlying dict.
         config_update_dict: dict[str, str] = config_update  # type: ignore[assignment]
-        if "url" in config_update_dict and "sha256" not in config_update_dict:
+        if "url" in config_update_dict and not config_update_dict.get("sha256"):
             url = config_update_dict["url"]
             existing_sha256 = config.get("sha256", "")
             if url == config.get("url") and existing_sha256:

bin/update_virtualenv.py

@@ -95,7 +95,14 @@ def update_virtualenv(force: bool, level: str) -> None:
     if latest_release.version > Version(local_version):
         version = latest_release.name
         url = latest_release.download_url
-        # Compute sha256 by streaming the new download
+        sha256 = ""  # recomputed below
+    else:
+        version = local_version
+        url = default["url"]
+        sha256 = default.get("sha256", "")
+
+    # Compute sha256 if not already stored (new version or first-time population)
+    if not sha256:
         log.info("Computing sha256 for %s...", url)
         response = requests.get(url, stream=True)
         response.raise_for_status()
@@ -103,10 +110,6 @@ def update_virtualenv(force: bool, level: str) -> None:
         for chunk in response.iter_content(65536):
             hasher.update(chunk)
         sha256 = hasher.hexdigest()
-    else:
-        version = local_version
-        url = default["url"]
-        sha256 = default.get("sha256", "")
 
     configurations["default"] = {
         "version": version,