[zjuncal]

The README documents that sha2_backend takes precedence over
sha2_256_backend and sha2_512_backend. However, setting the global backend
to riscv-zknh and either per-algorithm backend to soft selects the software
backend for that algorithm, because its soft branch is checked first.

Only honor per-algorithm soft overrides when the global backend is not
riscv-zknh. This restores the documented priority for both SHA-256 and
SHA-512 while preserving independent per-algorithm selection.

Add a regression check to the existing RISC-V CI job that cross-compiles with
global riscv-zknh and both per-algorithm soft overrides, then checks the
emitted assembly for SHA-256 and SHA-512 Zknh instructions. Checking digest
outputs alone would not detect this bug. Also add an entry under 0.11.2 (UNRELEASED) / Fixed in the changelog.

This is separate from #935, which corrected the SHA-512 configuration flag
and its intrinsics feature gate.