Verify Windows libmpv release downloads

[Blackspirits]

Summary

The Windows release workflow downloads the pinned x64 and ARM64 libmpv ZIPs and extracts them without validating the downloaded bytes.

This change pins the SHA-256 digest of both assets from the libmpv-2026-08-14b support-files release and verifies each ZIP before extraction.

Pinned digests:

• x64: ce99ee7a9cab0ada2f696b04132def67b0978157d5f4a1a7966d04c92aebbfec
• ARM64: d8be93f69eb102026ba81d5d237887b858701510c9e5e26996a2d30f9829df00

Validation

• both official release assets downloaded successfully
• both SHA-256 values matched
• both archives extracted successfully
• both bundles contained libmpv-2.dll
• validation run: #34547170245

AI assistance: ChatGPT was used to audit release download verification, retrieve the GitHub-published asset digests, and prepare this minimal workflow hardening change.

[Copilot]

@Blackspirits Thanks for sending me some feedback. Unfortunately, I hit an error while trying to use the custom Copilot setup steps configured for this repository. The error I am seeing is:

no supported setup-steps job found in your workflow file. Please ensure you have a job named copilot-code-review or copilot-setup-steps. For more details, see https://gh.io/copilot/actions-setup-steps

Once you or someone with the necessary access fixes the problem, please let me know in a comment and I'll try again. Thanks!

[Copilot]

🟢 Approval recommended

No unresolved issues remain.

Pull request overview

This pull request hardens the Windows release workflow by verifying SHA-256 digests for pinned x64 and ARM64 libmpv ZIPs before extraction.

Changes:

• Adds checksum validation for both libmpv assets.
• Prevents extraction when verification fails.

File summaries

File	Description
.github/workflows/build-ui.yml	Verifies both libmpv archives before packaging.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Blackspirits]

Independent adversarial re-review completed against current upstream context.

• Verified the pinned x64 digest ce99ee7a9cab0ada2f696b04132def67b0978157d5f4a1a7966d04c92aebbfec and ARM64 digest d8be93f69eb102026ba81d5d237887b858701510c9e5e26996a2d30f9829df00 against the GitHub release asset metadata for SubtitleEdit/support-files libmpv-2026-08-14b.
• Confirmed .github/workflows/build-ui.yml has not changed between review base 18ee110d88f14881e70eff2096a791322bf785c5 and current upstream c694526d77d92e98e5ed1449d4dbb1925a68adac, so the patch remains context-valid.
• Hash comparison occurs before each Expand-Archive; a mismatch fails the job before untrusted bytes are extracted.
• CI Tests run #34547418493 is green.

No blocker found. Keep this PR as an internal draft; no merge/promotion performed.