there's metadata in a GGUF (as can be seen when loading one into llama-server with verbose level 4) but it doesn't appear to show what the expected sha256 of the file is.
Well that would not work as the metadata is also part of the sha, and if you have a sha predictably contain or hash to itself you have a bad hashing algorithm. (Unless of course you mean sha of the weigths and not the gguf itself)
you can just hash the metadata masking out the hash as all zeroes or anything similar to get around that, like header checksums that ostensibly include themselves
With large downloads ideally they'd provide all the info upfront. Even some unique code in the name that you can look up in a readme on the site.