Also, given that "keep settings" is not recommended across major versions, what's the least painful way to get my router set back up the way it is now after upgrading from 18 to 19?
If you go to the Releases page and then click through to your build you'll find the sha256 there (here's mine for example). The easiest way to upgrade would probably be to generate a backup of your current build, then after upgrading copy your saved configs to your current build one by one while making sure everything still works.
…and if you do want to verify the authenticity of the sha256sum file, you'll find gpg- (sha256sum.asc) and signify-openbsd (sha256sum.sig) signatures for the sha256sum file right next to it.
I do not think that information is on the upgrade page, is it? If not perhaps we should have something like opkg list-installed to get a list of installed packages etc. before after?
Looks like it isn't, but it's a well known situation to those familiar with OpenWRT. It probably should be there, though.
Yes you could use opkg list-installed to get a list of packages if you're not sure which extra packages you may have installed. I keep a command in a text file for easy reference so when I do an upgrade I only have to run one command to install all packages I use regularly. This will also automatically install any dependencies for each package.
After the upgrade the router will reboot. Enter a SSH session from a terminal.
Type opkg update
Then type opkg install packagename1 packagename 2 listing all the packages you want to install. Opkg will install all dependencies automatically. Just one space between package names.