What good is a hash accompanying a program? After studying at length about weaknesses in SHA2, length extension attacks, forged signatures, etc. I have to ask why groups like Gnu provide hashes on their program texts?

As long as the public knows how the hashes were generated, a forger could substitute his own malicious code and cook up a totally valid hash for it, so that it would look legitimate.

So it appears that this is "security theater" which looks serious, but has really no way of assuring anything meaningful.
Well, if you can assume that the website hasn't been hacked, then providing a SHA2 hash of a program would allow you do make sure you downloaded (from anywhere on the internet) a good version of the software.

You are right, however, that since the method is publicly known, if someone can replace the binary on the site, they can also replace the hash on the site.

This is why a number of sites now publish PGP signatures of their software, instead of a simple hash. Now an attacker would have to forge the signature, which is computationally infeasible. This assumes that you know the valid public key. How do you get the public key? Well, that is another can of worms.