feedback from miod@ and deraadt@

SHA256 file).  Issue spotted by claudio.
ok miod

since we perhaps cannot assume that is what kernels will be in the
pathetically stupid world that SGI created

build the sets before we build the media.  While there we can get rid
of DESTDIR/snapshot too, and simply install straight into RELEASEDIR.
(This also ends up saving an astounding amount of traffic/latency in a nfs
environment)